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APPLIED ENGINEERING IS 100% APPLE 

Thar s Why We're So Good At It! 



THE NEW TIMEMASTER II 



Automatically dale 
tmnpi hies with 
PRO-DOS 




NEW I 1 *** 
DESIGN 
An oificiaJ 
PRO-OOS Clock 



• Just plug it in and your programs can read (he year, month, date, day, 
and time to 1 millisecond! The only dock with both year and ms. 

• A rechargeable NICad battery will keep the TIMEMASTER II running 
lor over ten years. 

• Powerful 2K ROM driver — Mo clock could be easier to us*. 

• Full emulation of most other clocks, including Thunderctock and 
Appleclock (but you'll like the TIMEMASTER II mode betted. 

We emulate other clocks by merely dropping off features. We can 
emulate them but they can' I emulate us. 

• Basic Machine Code. CP/M and Pascal software on Z disks! 

• E i gh i so ftwa re con trol led i nt erru pts so you can execute two programs 
at the same time (many examples are included). 

• On-board (inter lets you time any interval up to 48 days long down to 
the nearest millisecond. 

The TIMEMASTER II includes 2 disks with some really fantastic time 
oriented programs (over 40) including appointment book so you'll 
never forget to do anything again. Enter your appointments up to a 
year in advance then forget them. Appointment book will remind you 
in plenty ol time. Plus DOS dater so it will automatically add the date 
when disk Tiles are created or modified The disk is over a $200.00 
value along— we give (he software others sell. All software packages 
for business, data base management and communications are made 
to read the TIMEMASTER II. If you want the most powerful and the 
easiest to use dock for your Apple, you want a TIMEMASTER II. 

PRICE $129.00 



7-80. PICS' 




• TOTALLY compatible with ALL CP/M software. 

• The only 2-80 card with a special 2 K "CP/M detector" chip. 

• Fully compatible with microsoft disks (no pie-boot required). 

• S pecifically designed for high speed operation in the Apple lie (runs 
just as fast in the II+ and Franklin). 

• Runs WORD STAR, dBASE II, COBOL-80. FORTRAN-80. 
PEACH TREE and ALL other CP/M software with no pre- boot. 

• A semi-custom i.e. and a low parts count allows the Z-B0 Plus to lly 
thru CP/M programs at a very tow power level. (We use the Z-80A at 
fast 4MHZ.) 

• Does EVERYTHING the other Z-80 boards do, plus Z-80 interrupts. 

Don't confuse the Z-80 Plus with crude copies of the microsoft card. The 

Z-80 Plus employs a much more sophisticated and reliable design. With 

the Z-80 Plus you can access the largest body of software in existence. 

Twocomputerstnoneandtheadva ntages ofboth.allatanunbelievably 

tow price „■.,,-■■ •..,,. «« 

PRICI $T39.00 



Super Music Synthesizer 
Improved Hardware and Software 



^Rjfl^^ 




Complete 1 6 voice music synthesizer on one card, just plug it into 

your Apple, connect the audio cable (supplied) to your stereo, boot 

the disk supplied and you are ready to input and play songs. 

If s easy to program music with our compose software. You will start 

right away at inputting your favorite songs. The Hi- Res screen shows 

what you have entered in standard sheet music format. 

Now with new improved software tor the easiest and the lastest 

music input system available anywhere. 

We give you lots ol software In addition to Compose and Play 

programs. 2 disks are filled with over 30 songs ready to play 

Easy to program in Basic to generate com pie* sound effects. Now 

your games can have explosions, phaser zaps, tram whistles, death 

cries. You name it, this card can do it 

Four white noise generators which are great for sound effects. 

Plays music in true stereo as well as true discrete quadraphonic 

full control of attack, volume, decay, sustain and release. 

Will play songs written for ALF synthesizer (ALF software will not take 

advantage of all our card's features. Their software sounds the same 

in our synthesizer.) 

Our card will play notes from 10 HZ lo beyond human hearing 

Automatic shutoff on power-up or if reset is pushed. 

Marty many more features. PRICE $159 00 



Viewmaster 80 
There used to be about a dozen B0 column cards for the Apple, now 
(here's only ONE. 

• TOTALLY Videx Compatible. 

80 characters by 24 lines, with a sharp 7x9 dot matrix. 

On-board 40/80 soft video switch with manual 40 column override 

Fully compatible wilh ALL Apple languages and software— there are 

NO exceptions. 

Low power consumption through the use of CMOS devices. 

All connections are made with standard video connectors. 

Both upper and lower rase characters are standard. 

All new design (using a new Microprocessor based C.R.T. controller) 

for a beautiful razor sharp display. 

The VI EWMASTER incorporates all Ihe features of all other 60 column 

cards, plus many new improvements. 
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The VIEWMASTER B0 works with all 80 column applications induding CP/M, 
Pascal, WordStar. Format K. Easvwriter. Apple Writer II. Visit ale. and all 
others The VIEWMASTER 80 is THE MOST com pat, ble SO column card you 
can buy at ANY price! _■«....„„„ 

PRICE $179.00 



Expands your Apple lie to 192 K memory. 

Provides an 80 column text display 

Compatible with all Apple I le 80 column and extended 80 column 

card software (same physical size as Apple's 64 K card). 

Can be used as a solid state disk drive to make your programs run up 

to 20 times FASTER (the f>4K configuration will act as half a drive). 

Permits your lie to use the new double high resolution graphics. 

Automatically expands Visicalc (o 9S K storage in 80 columns! The 

64 K conlig. is all that's needed. I2BK can take you even higher. 

PRO-DOS will use the Memo ryMasterlleas a high speed disk drive. 



niefnoryMaster He 128K RAM Card 

• Precision software disk emulation for Basic Pascal and CP/M is 
available at a very low cosL NOT copy protected, 

• Documentation included, we show you how to use all 192K. 

II you a I r rad V h *v Apple I M X caid. just OftfFI Ihe M EMORVMAS T F * 1 1* with MHindUH 
*rM« lnnn ymu Did bund id [we yotl a lull t lax. IThi bunt n Mly wcknra »o vou 
tt/nply plug m mcjrr rhipLi 

MemoryMaster Me with 128k 1249 

Upgradeable MemoryMaster lie with 64 K $169 

Non-U pgrzdeabte MemoryMaster lie with 64K V149 



Oui bauds art In superior io moil ot the nuiuiMi nntmmn made today Alt I C.'i *■* m hignquabrv sockets with mit-ipec components used IhrositlsouL f C_ boards *e tlasv 
• nn "ills gold twudi Made in Ameiica to be ihe best in the „ortd Ail products wo* in thr ACHE tit. II II + and t lanklm The MemoryMislei tit » He onlv Aoptird t nc«>«r>r>c 
also man utact u res a lull li Be ol data arqtiisrt ion and com rol pronurrs lor itie Apple; A/O tonveitm and digital I/O cams, elt fleaie call lor mow irflonnation. All our products air hilly 
lesieo with (omolrle docummianon and available toi .mniKlmt delivery. All products are {uiumrnl with a no hassle IHIIE VIA* WA«*ANTT. 



Texas Residents Add 5% Sales Tax 

Add 510.00 If Oulside U.S.A. 

Dealer Inquiries Welcome 



Send Check or Money Order to: 

APPLIED ENGINEERING 

P.O. Box 791 

Carrollton. TX 75006 



Call (214) 492-2027 

8 a.m. to 1 1 p.m. 7 days a week 

MasterCard, Visa & CO.D, Welcome 

No extra charge for credit cards 
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By Barry May 

Unlock this powerful 

business and finance program 
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(RTTY/CW/TRANSFER) 
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This in-depth article explains the combined 
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Boot Code Tracing 
Hard Hat Mack 

By Rich Lyon 

Try this extensive bootcode trace 

that allows you to break this 

action arcade game 
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QUALITY GUARANTEED 

FOR A LIFETIME OF 

HEAVY DUTY USE 



$20.00 BOX OF 10 
WE PAY SHIPPING 




5%" SOFT SECTOR. 
SS/SD/, W/HUB RINGS 



data 
byte 



2361 TEE DRIVE 

LAKE HAVASU CITY, AZ. 86403 

(602) 855-1592 
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FIRE CRACKER 



FIRE CRACKER is a new hardware device to 

back-up your Apple disks. 

Does not use ANY slots. 

Compatible with all peripherals. 

Totally invisible to all software 

Gives Non-Autostart ROM capability 

Back-up is a normal BINARY file 



Package includes a 30-page users' manual and a two- 
sided disk of utilities. 

For the Apple ] [+ and compatible computers, 
INTRODUCTORY PRICE of $49.95 

To order or request info, write or call: 
MTL ENTERPRISES 
12841 Hawthorne Blvd., Box 589 
Hawthorne, CA 90250 
(213) 675-1200 

S49.95 VISA/MASTER CARD accepted. 
(Calif, residents add 6. 5% tax/ 
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Bit-Copier Detector? 

I enjoy your magazine very much 
and look (onward to each issue. The 
softkey on Magic Window II was par- 
ticularly helpful. 

I heard from an Apple salesman that 
the Apple company has incorporated 
a bit-copier detector in the ROM of the 
Apple He and that some bit-copiers will 
not work on the lie. He specifically 
mentioned Locksmith 4.1 as one that 
won't work. I have noticed that LS 4.1 
won't work on most things I've tried to 
copy on my He. Maybe you know 
something about this? 

G.F. Cox 
Newport NC 

Mr.Cox: Thank you for your compli- 
ments on our magazine and the soft- 
key for Magic Window. 

As to the rumor you heard about the 
Apple lie's bit-copier detector, we can 
only say that this one has to rank right 
up there with the reports of Paul 
McCartney's death. 

A bit-copier detector in ROM would 
require rather sophisticated routines 
which would have to check out any and 
all programs tnaf utilized the ROMs. 
This would not only slow down the ex- 
ecution of most programs on the lie but 
would practically eliminate the He's 
compatability with programs written for 
the Apple H's. 

Although we do not, as yet, have any 
experience w/th the Apple He, some bit- 
copy programs written for the II + may 
not work on the He because they call 
monitor ROM subroutines whose entry 
points may have changed slightly. 

Locksmith 5.0 is advertised as being 
Apple lie compatible. 

A Fix for Rana 

I may have a solution for Dan 
Cosper and all Rana drive controller 
owners who wish to do Boot Code 
Tracing [HARDCORE COMPUTIST 
#2J. 

While the Rana controller's ROM 
code is incompatible with the standard 
ROM and controller, the I/O address- 
es are supposed to be compatible 
since they will work with DOS 3.3. So, 
all they have to do is borrow some time 
on a computer with a standard con- 



troller and do the following; 

Boot a diskette with normal DOS 3.3 

8SAVE CONTROL ROM.A$C600,L$100 

When they want to do the boot code 
trace, instead of moving the controller 
ROM routine to $x600, just BLOAD the 
file CONTROL ROM at the address 
needed. They should be able to follow 
the boot code tracing procedures with 
no problem. 

Joseph W. Leathlean 
San Diego CA 

Joseph: Although we don't have a 
Rana disk drive to try this out on, it 
should work with no problems. 



More Reviews, Please 

I thoroughly enjoy your publication 
and have found it very useful. May I 
suggest more reviews, however? I 
would particularly like one on the latest 
generation of copy cards, including 
Alaska (by Central Point Software), 
Replay II, Snapshot, Copykit, etc. 



Some comments on the comparative 
advantages of having the copy soft- 
ware on diskette versus in ROM on the 
card should be included as well. 
Another article comparing the latest 
versions of Nibbles Away, Copy II Plus, 
Back It Up and covering such new pro- 
grams as "Essential Data Duplicator" 
and the "CIA" would probably be of 
great interest to your readers. 

James R. Weiner 
Brussels, Belgium 

James: See upcoming issues of HARD- 
CORE COMPUTIST for a review of the 
"Essential Data Duplicator" and the 
"CIA." 

All Gone 

Sometime ago [HARDCORE COM- 
PUTING #3 (old series)] you published 
a list of LS (Locksmith) parameters for 
users of Locksmith 4.1. This list indi- 
cated the PARM changes necessary 
for copying tracks of certain software 
available at that time. You also indicat- 




you NEED 



Th* Track Inspector is a 
replacement cover for 
Apple Disk II drives A 
uindou alloys visual 
inspection of th* booting 
process. Includes 
instructions for easy 
labeling of track 
locations on drives 



Track Inspector 



" It's a bit copier's friend " 

• Locate bad track copies FAST 
■ Locate tracks t half tracks 

to be copied FAST 

• Adjust drive speed without 

removing drive cower 

f 24.93 (Plus UPS; 

CT HFC, INC. 

224 EAST BROAD STREET 

GADSDEN, ALABAMA 35303 

(205) 547-2717 

Nostercharge, Uisa, or check. 



=J 
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Get On the 

RIGHT TRACK 

with Our New 

FLIP PAK™ 




JUSt 



*2 



00 



each!! 



well send you this hand- 
some smoke-colored acrylic 
diskette storage unit design- 
ed to hold 10 mini diskettes, 
along with a s 2 00 gift cer- 
tificate good towards your 
next purchase — all for only 

S2oo| 

HOME BASE SUPPLY 

422 Soquel Avenue 

Santa Cruz, OA 95062 

(408)458-1377 



C YESI Please send me 

fup paks @ s 2°° each... plus a s 2°° 
gift certificate good towards my 
next purchase. My check is en- 
closed. 

o i have accepted your special 

off er...5 units for S 8 00 J 

Name 



Address 



City. 



State 



Zip. 



HOME BASE SUPPLY 

422 Soquel Avenue 

Santa Cruz, ca 95062 

(408)458-1377 



ed in that article that the parameter in- 
formation was a reprint of several files 
maintained on the "SOURCE." As a 
new Apple lie user, I would appreciate 
any updates to the original LS 
parameter list you might have added 
since then. In particular, I would ap- 
preciate the most current LS 
parameter list you have available. 

Marvin Simon 
La Canada CA 

Marvin: Omega Software no longer 
maintains its list of Locksmith 
parameters on the SOURCE. They also 
no longer supply parameters for any 
program which has a backup available 
for $5. or less. We have published 
Locksmith parmameters in HARD- 
CORE COMPUTING #3 (old series) and 
in HARDCORE COMPUTIST #2 and 
currently have no additional 
parameters to print. Our readers are en- 
couraged to submit Locksmith and 
other bit-copier parameters to us so 
that we may update and publish our 
lists. 

ED: The following is an open letter sent 
to several Apple-oriented magazines. 



This is an open letter to all users of 
Apple computers who are concerned 
about the risks they are taking when 
they entrust their valuable data to 
copy-protected software. 

Users of application programs (as 
opposed to programmers and hob- 
byists/hackers) on microcomputers will 
generally find that they need three 
major types of application programs: 
word processor, data base manage- 
ment system and spreadsheet 

Pie Writer, a greatly enhanced and 
improved version of Apple Pie, is dis- 
tributed by Hayden Book Company 
and is, without question, the very best 
word processor for the Apple. No fur- 
ther discussion; the case is closed! 

The Spreadsheet 2.0 (also sold in 
stores as Magicalc) is the very inex- 
pensive spreadsheet program sold by 
the Apple Pugetsound Program 
Library Exchange {A.P.P.L.E). The 
Spreadsheet 2.0 may not be the 
fastest spreadsheet around, but it has 
some features which most of the 
others do not have. This includes the 
ability to display in 70-column mode 
without hardware, variable width 
columns and hidden columns. In ad- 
dition, some of the Visicalc-type utili- 
ties, such as Visiblend, seem to work 
quite well with the Spreadsheet. 



The Oata Reporter (Version 3.0) by 
Synergistic Software is its latest revi- 
sion and is just now appearing on the 
market. It is also the first version of the 
data base management system to be 
unlocked. Now, the fastest, most ver- 
satile and most fun-to-use DBMS can 
also be backed-up! Can Heaven be 
this good? 

For non-application uses (program- 
ming and such) there are also a num- 
ber of companies now putting out 
unlocked software. Almost any product 
from A.P.P.L.E. is assured of being a 
quality, useful item and, of course, 
everyone knows of the great stuff by 

Beagle Bros., as well as the policy of 
unlocked software which Penguin Soft- 
ware applies to its graphics. 

With this lineup of unlocked pro- 
grams, it should never again be neces- 
sary to use copy-protected software. 

The reason more and more pro- 
grams are now being sold on unlocked 
disks and are still making a profit for 
their companies is that it has become 
quite clear to these companies that ap- 
plication programs (as opposed to 
games and other trivia) are virtually 
useless without the documentation 
and manuals which go with them. 

Companies which continue to try to 
palm off copy-protected software have 
not yet learned that it is good, useable 
documentation which keeps a program 
of this type from being pirated, not the 
expensive and useless copy-protection 
schemes they are using and which are 
doing nothing but causing frustration 
and anger among the users of such 
software. 

Not only are each of the programs 
mentioned above outstanding in its 
own right, but the fact that they are un- 
locked makes them even more attrac- 
tive. I feel we all should support those 
companies which make it a matter of 
policy to sell unprotected software and 
if the software is among the best in its 
class what else need be said? 

Thus, we can send a message to 
these other rip-off producers and sup- 
pliers telling them that we now have 
quality programs for all our needs on 
unlocked disks and that we will no 
longer be forced into buying protect- 
ed software and entrusting our valua- 
ble data to the hidden innards of such 
programs. 

Thomas E. Militello, M.D. 
Rancho Palos Verdes CA 



Dr. Militello: You are absolutely right, 
the better the sales of well-written, non- 
copy-protected software, the sooner 
the extinction of the copy-protected 
dinosaur. 
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Copy Protection Tips 

Several notes. First I love your 
magazine! It's probably the best Apple- 
oriented magazine of the market. Se- 
cond, the crack that was published for 
Zork I works on all Infocom games: 
Zork I, Zork II, Zork IN, Starcross, Sus- 
pended, Deadline. Witness, Planetfall, 
Enchantor and Infidel. I have tried 
them all, so I know how it works. 

And for all the potential backer- 
uppers out there I heartily recommend 
"The Essential Data Duplicator" and 
"The CIA." These are both extremely 
powerful and also have detailed expla- 
nations of the processes involved. NMI 
cards are almost useless, because 
most programs can now recognize if 
they have been interrupted by one. 
And finally, here are some of my own 
softkeys. 

Homeword, by Sierra On-Line 

copy with COPYA, then edit 

track 10, sector 0A 

Bytes 9-A from 49 C9 to EA 60 

That's it! 

Aztec, by Datamost 

use the modified COPYA from 
Zork or Witness softkey, then 



modify track 0, sector 3, Byte 42 
from 38 to 18 

And a final note on copy protection us- 
ing normal DOS 3.3: 



CALL-15t 

B8A3:92 

B99B:92 

B93F:92 

BCB3:92 

3D0G 

INIT HELLO 



This protects against standard copiers. 
If you want to protect against bit- 
copiers, make 92, 91 instead. Try it. It 
works great. 

Marco Hunter 
Los Angeles CA 



Sensible Speller? 



I am a long time subscriber from the 
first, and have been trying to follow the 
examples which you publish so that I 



might be able to backup some of my 
own software. Between the various 
copy programs and some of my own 
flubbing around, I have done fairty well; 
however, a program which I own beats 
me: Sensible Speller by Sensible 
Software. 

I am not able to copy this program 
with any copy program I have: Lock- 
smith, Copy II + version 4.3, 1 have not 
been able to view or edit tracks 00 or 
01. 

Do you have any suggestions or the 
latest parms for this program? 

I would like to see someone publish 
a tutorial on copy- protection breaking 
which would start out at the novice 
level. 

Frank McDonald 
Laguna Hills CA 



Mr. McDonald: We have received 
several inquiries like yours concerning 
Sensible Speller and unfortunately, we 
do not know of any backup method of 
the new version of this program. 
Perhaps another one of our readers 
could respond to your plea via our IN- 
PUT column. 

continued on page 7 



YOU WANT IT? YOU GOT ITI 

More hardcore, 

more CORE, 

and more straight-forward knowledge about disk access. 

You and all of our other readers are active members of our editorial sounding board. Apple computists communi- 
cate through the pages of our magazine. We are an unrestricted forum of specialized information exchange and 

ideas. 

At Softkey Publishing, we place no limits on what our readers should know. 

So, beginning with hardcore COMPUTIST #6 (the next issue), each issue will give you the controversial articles 
of hardcore COMPUTIST and the expansive tutorials of CORE. 

Now, when we receive a great utilities article, we won't have to wait until our next CORE Utilities issue. And, if 
someone sends in a softkey for Multiptan, we won't have to hold it back until the next issue of hardcore COMPUTIST. 

Because of our new receptive format, we can print topical articles on any subject every month in the CORE sec- 
tion while still filling the rest of the magazine with new softkeys, tech info, APT's and programming tips. 

Get ready for Hardcore COMPUTIST #6. 
It's gonna knock your disks off I 

The CORE section features a Data Base introduction and some words on a Data Base Management System. 
More later. 
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Highest Quality, Lifetime Guarantee! 

DISKETTES 

(£ 1 g'Q 5%" soft-sectored. with 
Jp J. •\}J envelopes, hub ring, double 
density, double-sided on APPLE and other 
computers not using timing pulse holes. 
Order 100 for $155. " 

<£ 1 1 G ^ or bu "* P aks of 1 °0 of above, 
kJ)A4V single-sided. Hard plastic 
stand-up 10-diskette carrying cases $2.75 
each, 4 for $10 (beige, black, blue, green, 
red, grey, yellow). 

Disk Drives 

Cl OQ 100% APPLE-compatible, 40- 
kpiy" track, full-size, Siemens type 
quality drives, with manufacturer's 1-year 
warrantee. 

Add $2 to total order for UPS shipping or ($5 
for drives), plus $2 for COD or $4 for credit 
card or invoiced orders. Xo^t rC^l 

VF ASSOCIATES 

6327 Western Ave. . N. W., Wash.. DC. 20015 
(202)363-1313 



Dear Subscriber: 

Help Us Out! 



We would like to reduce the mailing time for your issues of 
Hardcore/CORE. 

When filling out subscription forms, or writing to us for 
information: 

Please print name and return address 

legibly 

and, if you are a current subscriber, your record number 
When using Mastercard or VISA for subscription payment, 
the card number, expiration date, and your signature must 
accompany your order. Your subscription cannot be 
processed without this information. 

To our subscribers with APO/FPO addresses 

On our renewal card, the suggested subscription rate is 
$34.00. This is for a subscription that is mailed with 1st Class 
postage. We suggest 1st Class rather than 3rd Class (bulk) 
mailing to avoid the 4-8 week delay required for your maga- 
zine to reach you at bulk rates. 1st Class will reach you in 
less than two weeks. 

1st Class postage is only recommended. The higher rate 
subscription is not required. 

For further information, please direct you questions to the 
circulation department. 



Complete, Commented Source Code! 

Our software is not onlv unlocked and fullv copvable 

...we often provide the complete source code on disk, at unbelievable prices! 



S-C Macro Assembler. The key to unlocking all the 
mysteries of machine language. Combined editor' 
assembler with 29 commands. 20 directives. Macros, 
conditional assembly, global replace, edit, and more. 
Highest rating "The Book of Apple Software" in 1983 
and 1984. 580. 

Powerful cross-assembler modules also available to 
owners of S-C Macro Assembler. You can develop soft- 
ware on your Apple for 6800. 6805. 6809. 68000. 8085, 
8048, 8051, 1802. LSI-11. and Z-80 microprocessors. 
S50 each. 

S-CXref. A support program which works with I he S-C 
Macro Assembler to generate an alphabetized listing of 
all labels in a source file, showing with each label the 
the line number where it is defined along with all line 
numbers containing references to the label. You get the 
complete source code for this amazingly fast program. 
on disk in format for S-C Macro Assembler. $50. 

Full Screen Editor. Integrates with the built-in line- 
oriented editor in the S-C Macro Assembler to provide 
a powerful full-screen editor for your assembly lan- 
guage source files. Drivers for Videx, STBBO.and Apple 
lie 80-column boards are included, as well as standard 

1 40-column version. Requires 64k RAM in your Apple. 

V^ Complete source code on disk included. $50, 



S-C Docti- Mentor for Applesoft. Complete documenta- 
tion of Applesoft internals. Using your ROM Applesoft. 
produces ready-to-assemble source code with full 
labels and comments. Educational, entertaining, and 
extremely helpful. Requires S-C Macro Assembler and 
two disk drives. $50. 

S-C Word Processor. The one we use for manuals. 
letters, our monthly newsletter, and whatever. 40- 
columnsonly, requires iower-case display and shiftkey 
mod. Works with standard DOS Ipxt files, but at super 
fast (100 sectors in 7 seconds). No competition to 
WordStar, but you get complete source code! $50. 

Apple Assembly Line. Monthly newsletter published 
since October, 1980. for assembly language pro- 
grammers or those who would like to be. Tutorial arti- 
cles, advanced techniques, handy utility programs, 
and commented listings of code in DOS. ProDOS. and 
the Apple ROMs. Helps you get the most out of your 
Apple! $18 year. 



S-C SOFTWARE CORPORATION 
2331 Gus Thomas son. Suite 125 
Dallas, TX 75228 (214) 324-2050 

Professional Apple Software Since 1978 

Vm. MaiwiCwo. fcnwem Eiprra COD scupoa 
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Use a Pascal Zap 



There is a problem with the Softkey for Bag of Tricks in 
HARDCORE COMPUTIST #3. The problem is with the ZAP 
program. It will not let you catalog a Pascal Disk. The 
problem is at $03D9 which does a JMP to $B7B5, the 
RWTS subroutine in DOS 3.3. 

To have it work with ZAP, it, instead, needs to JMP to 
S77B5 in the SUPPLEMENT program. Add this line to the 
HELLO program: 
115 POKE 987,119 

Ken Simons 

Salt Lake City, UT 

Ken: You are absolutely right there is a problem with the 
Softkey for the Bag of Tricks. For a complete fix of any 
problems you may have had with the deprotected version 
of this program see the article "Fixing the Softkey for Bag 
of Tricks" on page 14 of this issue. 

Copy Co-operation 

I recently tried to backup a copy of Spy's Demise by Pen- 
guin Software according to the instructions given under the 
Copy II + parameter list in issue 3. For the disk I have these 
parameters would not work properiy. I would get only the 
title picture, but no game. After some experimentation with 
other programs I found that the disk would copy easily by 
using Locksmith 4.1 for tracks to 12 (error 2 on track 12 
is okay) and Nibbles Away II on tracks 1 , 5 and 7. Lock- 
smith was apparently not able to copy those tracks. No 
parameter changes were required for either copy program 
and it was not necessary to copy any other tracks 

Peter M. Anker M.D. 
Harrisburg, PA 

Or Anker: In our experience, software companies often will 
use more than one protection scheme on a particular 
product. For this reason you will often find more than one 
set of parameters listed for a given disk. Possibly this was 
the reason that Copy II + would not back up this disk for you. 

You should also be aware that bit-copier parameters are 
usually submitted by users like yourself and are not verified 
by the distributor of the copy program or by our staff. 

Thank you very much for your tip on how to backup Spy's 
Demise, Your "mix and match" use of bit-copiers is bound 
to sweep the planet. 

Wizardry Back-Up 

Looking through your last HARDCORE issues, I saw on 
the softkey parameter exchange how to backup Wizardry 
by Sir-Tech. While the program uses state-of-the-art copy 
protection, there is a much simpler way of making a back- 
up and it works every time, not just 3 out of 5 times. 

First copy tracks 0-22 unsync with auto retry. Or if, like 
me, you hate using Locksmith because it is so slow, you 
can use COPYA to copy the disk. After copying the disk 
with Locksmith or COPYA, go back to Locksmith and copy 
track 0A-0E SYNC and change these to 
parameters....46 = 96, 21 =02. 

That's it and have fun. 



Greg Burns 
New Canaan, CT 



JF 



NOW— Full Power Assembly Language!! 

Get the versatility of independently assembled 
relocatable subroutines with a 

RELOCATING LINKING 
LOADER 

• For use with Apple DOS tool kit assembler REL files 

• Relocate and link up to 255 REL files 

• Convenient specification of relocation parameters (output 
file, start address, REL file names, . .) in text control file 

• Comprehensive error reporting and recovery 

• Memory map has module and entry point addresses to 

aid debugging 

• Complete with user manual and disk example 

• FAST-Ten 256 byte REL files done in 30 seconds 

Relocating Linking Loader with Manual S49.95 

Manual S4.50 

Kiwi Software does NOT copy protect fts products. 

Check or M.Q (NJ residents add 6% sales tax} 
Kiwi Software Company, P0. Box 218-H 
Rainsboro, NJ 08536 
System reo: Apple II. II + . He (or comoaltfe) DOS 3.3 w/48K 

*a* b i tradem** a tout Uncut* rt 



Input/Output Made Easy! 

The yCHOOO™ I/O System far Apple II* simplifies 
computer control. Software support allows control of all 
inputs and outputs using simple BASIC variable names. 
System includes two boards shown, cables. 60-page 
manual and disk. 

Special Introductory price 5*77i 




User Interface Module 

4 Analog Input Generators 
8 Digital Input Switches 
8 Digital Output Indicators 
Uses 9-V Battery No External 
Rawer Required 
Jacks to User Circuits 
Parallel Jack to Computer 




Apple Interface Board 

1 Adjustable Reference 

2 8 Channel A/D 

3 8 Analog inputs 

4 8 Digital Inputs 

5 8 Buffered Digital Outputs 

6 Gold Plated Connector Plugs 
into *xir Apple 

7 Digital Surfer 

8 Peripheral Interface Adapter 



wcffrrrrm^r^m^ 



TM 



A' 

/ I n no va 1 1 v* Mlcroc o m put e r En ha nc e ment Systems 

4860 East 34Sth Street • Willougn&y. Ohm 44094 • |2I6| 953-8414 

'Awe II ii j reentered trademark erf Apple Compute! Inc 
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READERS' SOETHEV & COPY EXCHANGE 



BACKING-UP DARK CRYSTAL 
By Clay Harrell 

Dark Crystal 

Sierra On-Line 

Sierra On-Line Building 

Coarsegold, CA 93614 

$39.95 

Requirements: 

48K Apple 

One disk drive with DOS 3.3 

A Sector Editor 

4 blank disks 

Whenever I invest in an adventure 
game about the first thing I try to do 
is to back it up. Adventures are prone 
to disk failure due to the large amount 
of disk access done during play. 

Dark Crystal is copyable with just 
COPYA on all four sides. I suggest if 
you have a copy to go and make back- 
ups now. 

Unfortunately, disk one, side A, will 
not work unless you make some byte 
changes to the disk. 

The protection lies after the hi-res ti- 
tles pages appear at location $5FF0. 
This routine pulls and pushes some 
bytes from the stack and later com- 
pares them. If we bypass this routine, 
Dark Crystal becomes unprotected. 



Note: you only need to make these 

byte changes to disk one, side A, of the 
Dark Crystal. 

1 ) Using COPYA, make copies of all 
four sides of the Dark Crystal. 

2) Run a Sector Editor and insert 
disk one, side A, of your copy of Dark 
Crystal. 

3) Make the following changes to the 
disk and write sectors back out: 



Trk Sect Byte From To 

5 F A8 20 EA 

5 F A9 F0 EA 

5 F AA 5F EA 



7 
7 

7 



C 
C 

c 



22 
23 

24 



20 

F0 
F5 



EA 
EA 
EA 



That's all it takes for the de-protection 
of Dark Crystal. 



SCREENWRITER II SOFTKEY 
By Daniel Price 

Screenwriter II 
Sierra On-Line 
Sierra On-Line Building 
Coarsegold, CA 93614 
5129.95 

Requirements: 

Apple II + /lie, 48K and at least one 

disk drive 

Screenwriter II master diskette 

A blank diskette 

FID or COPYA 

The Screenwriter II word processor 
is a powerful writing tool, combining 
many advanced features with ease of 
use. The only problem is that you cant 
back it up. 

I found this particularly upsetting be- 
cause the program is stored as a ser- 
ies of binary files on an almost 
standard DOS 3.3 diskette. This me- 
ans that the diskette can be copied 
with FID or COPYA but the data that 
tells the copy protection routine that 
the diskette is an original is lost (the in- 
formation is coded into the formatting 
of the diskette) and the program won't 
run. Fortunately, the way to unlock this 
disk is very simple. 

What we will do in this procedure is 
remove a machine language JSR 
(Jump to Subroutine) instruction and 
bypass a particularly nasty subroutine 
which checks the disk to see if it is an 
original. If this routine found that the 
disk was a copy, it would clear the 
memory and reboot. 

Step one: Make a backup of the dis- 
kette with either FID or COPYA and 
hide the original! I can't stress the im- 
portance of this enough. It is too easy 
to make a fatal mistake and have your 
only copy destroyed. 

IF YOU USE FID: Boot the original 
disk. When the main menu appears 
press Control-C to enter BASIC. Re- 
move your master diskette and insert 
your backup. Type the following: 

NEW 

INIT START 

DELETE START 

Now use FID to copy all the pro- 
grams which are on the master dis- 
kette onto the backup. 

IF YOU USE COPYA: Just boot 
any DOS 3.3 diskette, 

RUN COPYA 

and follow its directions. 



Step two: We will now make the ac- 
tual changes to the program. These 
changes consist of a three-byte patch 
to two files on the diskette. Check to 
make sure your master diskette is hid- 
den (just remember how much this 
program cost!) Now, with the backup 
in the drive, do the following: 

1) Enter the monitor 
CALL- 151 

2) Load the first file 
BLOAD RPART1 

3) Make the first patch 
1F90:EA EA EA 

4) Save the changes 
BSAVE RPARTt,A$C00,LS1400 

5) Load the second file 
BLOAD EDITOR PART2.0BJQ 

6) Make the second patch 
1F49:EA EA EA 

7) Save these changes 

BSAVE EDITOR PART1.OBJ0, 
ASC0O,L$1400 

The Screenwriter II is now unlocked 
and can be backed-up with COPYA or 
FID as many times as you like without 
needing any further changes. 

If you use a different DOS, you must 
arrange to BRUN the file named 
START upon booting. This may be ac- 
complished by creating a HELLO file 
to do it or by patching DOS directly. 

The procedure to patch DOS 3.3 to 
BRUN a binary file upon booting is: 
First, boot a DOS 3.3 diskette, then 
type: 

POKE 40514,52 

Any diskette INlTed with this DOS 
will BRUN whatever file you specified 
in the INIT command. 

A. note to those who own Quality 
Software's "Bag of Tricks.'' The INIT 
program's reskew function can be 
used to greatly increase the Screen- 
writer ll's efficiency in loading, saving 
and packing files. Reskew the Screen- 
writer II program diskette (your back- 
up!) tracks 3-22 to 9 DESCENDING 
and the TARGET and TEXT diskettes 
tracks 0-22 to 6 DESCENDING. 



Note: The softkey for Screenwriter II 
was not verified by our staff. 



Page 8 



hardcore COMPUTIST no.5 



SOFTKEY FOR VISIFILE 
By Bob Bragner 

Visifile 

VisiCorp 

2895 Zanker Rd 

San Jose, CA 95134 

Requirements: 

48K Apple or an Apple He 

Visifile 

Two blank disks 

Apple's COPYA program 

A disk zap utility, such as The inspec- 
tor or Watson 

(An Applesoft Program Line Editor, 
e.g. such as Konzen's GPLE, is use- 
ful but not essential) 

Visifile is a medium-powered, some- 
what overpriced, data base manager. 
My first (original) copy got zapped 
when the Turkish Electric Company 
hiccuped during a configuration file 
write on the master disk. Since I didn't 
have a backup and I knew that the 
disks were protected, I packed both of 
them off to VisiCorp along with a check 
for $30 for a replacement. 

After nearly two months the disks fi- 
nally made their way back across the 
Atlantic and Mediterranean with the 
enchanting message: "Undeliverable 
at this Address" stamped on the pack- 
age! VisiCorp had apparently moved 
and not notified the Post Office. 

By this time I had of course found 
their new address (no thanks to them) 
and, once again, shipped the disks off 
with a somewhat caustic letter. This 
time the disks were returned: updated 
and with a backup to boot (sorry for the 
pun) in about three weeks. 

Nevertheless, having been burned 
once, I decided I had to have my own 
copyable Visifile. Locksmith will copy 
it, but with a lot of annoying parameter 
changes and the copy will remain pro- 
tected. I wanted a "cracked" version 
and backups squirrelled all over the 
place. 

Pirates' Harbor published a crack for 
Visifile about six months ago. It con- 
sisted of copying the disk with COP- 
YA, then, changing one byte in one of 
the sectors on the disk, using a disk 
zap utility tike Watson. COPYA, 
however, refused to copy my disk. Ev- 
ery time! tried it, I got an *•*•*•** UN- 
ABLE TO WRITE " error when 

the program tried to format the blank 
disk. 

Using Watson, I was able to 
determine that there were no protect- 
ed sectors on the original disk. FID 
could move all the files (except for the 
dummy serial number) over to another 
disk, but if you try to boot the result, 
the screen fills up with inverse "A's." 

After using the FIXCAT utility from 



Bag of Tricks on the original, it was 
clear that there were some peculiar 
things in the catalog track. For one 
thing, the volume number appeared to 
be 255 ($FF: an invalid volume num- 
ber!) even though it showed up as 254, 
when you looked at the catalog. 

If you examine line 250 of the COP- 
YA program you will see: 

250 PRINT "INIT XXX, S" SS",D" 
SD". V" PEEK(714):FT = 1 

Checking the value at location 714, 
after COPYA crashes, reveals that 
there is indeed a 255 there. So change 
line 250 to read: 

250 PRINT "INIT XXX.S" SS ",D" 
SD", V" PEEK(714)-1:FT = 1 

and then RUN. COPYA will make a 
perfect copy of both Visifile disks. 
These copies can be copied as much 
as you like by a normal, unaltered 
COPYA. 

However if you try to boot Disk 1 , 
you still get a screenful of reversed 
"A's." After a bit more snooping, it 
was easy to determine that the Diowup 
occurred when the file VISIFILE.BIN 
on Disk 1 was BRUN. 

A quick disassembly of this file didn't 
reveal anything significant (although 
there is a section where there are a 
bunch of reversed "A's," but, then, I 
remembered the Pirates' Harbor 
crack: byte $2D of track $22, sector 
$04, was supposed to change 
from $0A to $0F and this sector was 
part of the VISIFILE.BIN file! 

After making this change with Wat- 
son, I booted tne resulting disk and all 
was well. 

Here is a step-by-step procedure to 
crack Visifile: 

(1) LOAD COPYA 

(2) Edit line 250 by inserting 
"-1 "after the PEEK(714) 

(3) If GPLE is lurking around, re- 
move it before you attempt to make a 
copy. 

(4) RUN the program in memory and 
follow normal copy procedures. 
Repeat step 4 for Visifile Disk 1 and 
Disk 2. 

(5) Enter your favorite disk zapper 
and read track $22, sector $04 of the 
copy of disk 1. Change byte $2D from 
$0A to $0F. Write this change to the 
copied disk. "Red Rebel," of Pirates' 
Harbor, deserves the credit for the dis- 
covery. 

You now have a cracked copy of 
Visifile from which you can make all 
the backups you want, using normal 
copy procedures. 

Do you want a faster sort routine? 
Hard disk capability? With your 
cracked Visifile, you are now free to 
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modify to your heart's content. 

Note: The Softkey for Visifile was not 

verified by our staff. 

BACKING-UP LANCASTER 
By Clay Harrell 

Lancaster 

Silicon Valley Systems 

1625 ElCamino Real 

Belmont, CA 94002 

Requirements: 

48K Apple, with Applesoft 

One disk drive and DOS 3.3 

DOS 3.3 System Master 

Lancaster 

One blank disk 

Lancaster caught my eye as having 
unusually smooth animation and 
graphics. Being intrigued by the ani- 
mation and payability of the game, I 
bought it with the intention of discover- 
ing the author's methods of animation. 

But, in order to snoop through the 
code it, naturally, meant that I had to 
unprotect it first for disassembly. 

The first thing to notice upon boot- 
ing the game is that an Applesoft cur- 
sor appears at the bottom left of the 
screen. 

This means that the protection in- 
volves somewhat of a normal DOS and 
disk structure. 

continued on page 12 
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• Closed Files are Stackable 



SQ95 



9 



t AM *I SO 

Mm I Mnrifef 

C*s/i. CMC* or M O, No C O Q.'i 



out one 



*2 0*m Straw Oapi h 



Page 9 



Getting On The 



By Robert Linden 

Requirements: 

Apple 11 + or compatible with disk 
drive 

Bit copier, sector editor or other pro- 
gram that seeks specific tracks on 
demand. 

STABILO fine-point pen, or other 
similar marker. 

When making backups of copy- 
protected programs, there will be times 
when the backup will not boot. 

It might keep rebooting continuous- 
ly, spin with no head movement, stop, 
or do something else it shouldn't. 
Often this is the result of just a few 
tracks being incorrectly backed-up. 
Finding these tracks quickly will speed 
up your task greatly. Here's how: 

Turn off your computer. Remove the 
screws holding the cover on your disk 
drive (WARNING: this could void your 
warranty) and slide the cover to the 
rear and off the drive. 

Turn on your computer and boot a 
program that seeks specific tracks on 
demand. 



Now you will need to find both the 
frame that holds the read/write head 
and the cam that drives this frame (see 
figure 1). 

Have the drive seek track 0, then 
track 22 (hex), while viewing the interi- 
or of the drive from one side. The ob- 
ject moving rapidly over (and under) 
the disk is the frame that holds the 
read/write head. Below this frame you 
will see a three-to-four-inch round 
object which turns only when the frame 
moves. This is the cam that drives the 
frame holding the read/write head. 

A common method of indicating 
tracks for future use is to place a refer- 
ence mark on the read/write frame and 
then, as the drive is stepped through 
the tracks by the track-seeking 
program, to mark each track on a near- 
by, motionless part of the drive. 

The problem with this method is that 
the marks are as close together as the 
tracks on the disk. To greatly increase 
the distance between the track marks 
I prefer marking the cam instead. 

If your cam is made of shiny plastic, 
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you will need a fiber-tip pen, intended 
for writing on plastic, such as a STABI- 
LO fine-point. If your cam is made of 
rough plastic, similar to Bakelite, you 
could use paint for greater visibility. In 
this case use a water-based, model 
paint to avoid any risk of the paint dis- 
solving part of the cam. Use a fine- 
tipped brush and, if you like, several 
different colors to ease the identifica- 
tion of the tracks. Whichever method 

When making backups of 
copy-protected programs, 
there will be times when the 
backup will not boot. Often 
this is the result of a few 
tracks being incorrectly 
backed-up. Finding these 
tracks will simplify your 
task. 

you use, make a test mark on the cam 
to be sure the marks will adhere. 

First, place a reference mark on the 
most easily visible spot that is directly 
next to the cam. 

Then, have the drive seek track 
and place a mark on the vertical edge 
of the cam. Make sure this mark lines 
up with the reference mark. 

If you feel uneasy about touching the 
interior of the drive while it's on, or if 
you're not sure about what you can 
and can't touch, you should turn off the 
computer after seeking a track and 
then turn it on again after you have 
finished the marking for that track. 

Next, have the drive seek track 18 
(hex). On my drive this will turn the 
cam one complete revolution to the 
mark made for track 0. If your drive is 
different, find the track that does line 
up to the mark (or track 0. On top of 
the cam, above the mark, write a small 
0/18. Do NOT place any marks in the 
spiral groove that is engraved on top 
of the cam. This groove is used by the 
cam to move the read/write head, so 
take care not to gum it up. 

Note where the read/write frame is, 
in relation to the center of the cam. 
Now have the drive seek track again. 
You will notice that the read/write 
frame has moved much closer to the 
edge of the cam. This is how you can 
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Right Track 



tell if the drive is on track or track 1 8. 

Now work your way around the cam, 
seeking each track, marking it and 
labeling it, until you get to track 22. I 
label each track in hex (i.e., base 16) 
instead of base 10 since most refer- 
ences to the tracks are in hex. Note 
that the marks for tracks 18-22 (hex) 
will overlap with the marks for tracks 
0-10 (hex). In the case where two 
tracks use the same marks you must 
take note of the read/write head frame 
in relation to the cam in order to dis- 
tinguish which track is being accessed. 

You are now ready to make a 
backup. 

Boot the disk to be backed-up while 
you watch the cam to see if the drive 
seeks any Vj tracks or anything past 
track 22. 

Using this information, try to make 
a backup. If the backup will not boot 
properly, watch the tracks over which 



the drive goes before the backup fails. 
These are the tracks which have one 
or more bad sectors on them. If the 
drive stops or spins continuously on 
one track, re-do that one track, tf the 
drive seeks the same tracks over and 
over again, when it did not do that on 
the original disk, then re-do those 
tracks. Good luck! fc . 




DIVERSI-DOS IS THE BEST 



**• NEW *** NEW *** NEW *** 

TLIST — Lists BASIC files without destroying the 
program in memory. U*« TUST to cow l™* 
from one program to another I Improved bit 
formal without indents, for easier editing / Visible 
control characters / Also bsts program m memory 
with improved format 

Insert' Delete Mode — Makes program editing a 
pleasure! Insert characters in the middle of a line 
without re -typing. Also works lor data entry 1 

Keyboard MACROS — Enter whose phrases with 
■ single keystroke! Make your men custom editing 
keys, or redefine your entire keyboard (Dvorak 
keyboard i nc hided) 

Wildcard (lie names — Enter only the first tew 
tetters of a We name (searches the directory for a 
match) 

BSAVE — "A" and "L* parameters are not 

necessary (uses "A" and "L" from last BLOAD) 
Recognisable ESCAPE and INSERT mode c 
Lowercase DOS commands accepted 
Catalog abort key 
Lists text files to screen or printer 



WHAT ARE YOU WATTING FOR??? 

Are you tired of waiting lor DOS 10 load and save 
files' Are you tired of waning for DOS 10 finish so 
you can type again? Are you tired ol waning lor 
your pnnter 9 When you buy DIVERSI-DOS". 
by Bill Basham, you won't haw to wail any more' 
Here's why: 

1 DOS speed up- Apple DOS 3 3 takes 18 disk 
revolutions 10 read a single ttack. whereas 
DIVERSI-DOS leads of writes a track m |ust 2 
resolutions. This speeds up file processing 
tremendously (see table) 

2 Keyboard Buffer: DIVERSI-DOS allows you 
to type ahead, as fast as you can. without missing 
a single character. 

3 Prwii Buffer DIVERSI-DOS can use a RAM 
card I16K 128K) to temporarily save characters 
before they are printed Thus, your computer 
won't have to wait for your printer to finish. 

4 DDMOVER DIVERSI-DOS can now be 
moved to a RAM card to increase the available 
memory in a BASIC program 
DIVERSI-DOS, the QUADRUPLE utiKiy. 
requires a 48K Apple II. II* ot , e with DOS 3.3. A 
simple, menu-driven installation program is 
included on tl» unprotected disk. So what ate 
you waiting lor? 



ORDER TOLL-FREE 

Call MOW: 800 835-2246 em. 127 (orders only! 

For information, call SIS 877 1343 

Disks normally shipped within 24 hours. 

Only S30 Irtludes Isl class or foreign airmail. 

Sold by mail order only. 

Return in 30 days for full refund, if not totally 

satisfied! 



FREE - with your order — FREE 
DOGFIGHT* It - By Bill Basham 
— A special mail-order version ol the arcade 
game for 1 to 8 players, recently listed «6on the 
best seller list! 



"Of all the DOS enhancement packages reviewed 
in Peeling II lo date. DIVERSI-DOS is the most 
powerful in terms of its capabilities coupled with 
us puce DIVERSI-DOS » the only product to 
speed up all areas of DOS-LOAD BLOAD. 
RUN BRUN SAVE BSAVE. as well as I he 
READ and WRITE of text files The 
documentation is superb. [Rating AA1" 
— Peelings II Magazine 



Send 130 (US funds) to: 
Diversified Software Research, Inc 
S848 Crampton Court 
Rockford. Illinois 61 111 



db[ 



Address 



City 



save: 

load: 

BSAVE' 

BLOAD* 

READ" 

WHITE" 

APPEND*^ 



APPLE DOS 

r. i -« 

- . vr 

13 SMC. 

Mb Ml 

llJtK. 



DIVERSI-DOS 

S.t*K- 

11 Ht. 

4 1 IK 

.'» »»r 

let w 



t SO-Mtnw BASIC pn)ii- 



1 tf-WCHM 1111 (M 



Srjie 



. Zip Cod- 



V-u Mastercard. COD « personal check accepted 
C«d • 



Eip Date: 



.J 
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ESSENTIAL DATA DUPLICATOR 



• EDD rawly needs parameter changing 

• Automatically finds the beginning of each track 

• Unlike any of the Copycards, EDD backs up the entire disk, 

not just what is in memory 

• Accurately finds "auto-sync" bytes and their lengths 

• Can copy '/« and % trades 

to oenr-ff or for mcwe in* okmanoiv car IK7\ ist-2*X 
UTILICO MICROWARE 33T7 Solano Ave . Suite 352. Napa. CA 94558 



Know where your head is, at all times, 
with TRAK STAR constant digital readout 




• Saves copying time 

• For nibble programs 

+ Wonts with nibble copy programs 10 display 
tracks ond hoit-trocits that the program accesses 

+ Operates with any Apple' compattile program 
+ Saye lime by copying only Ihe frocks be*»g used 

+ Displays up to BO tracks ana ha#- tracks. 

compatible with hign density drive*. 
+ it copied program doesn t run. Trait Star displays 

track to oe recooed 
+ Compact size permits placement on top of 

disk drive. 
+ Does not use a slot in the Appto* computer 
+ For Apple* H. IH- and //• 
Apple it a reoarerad trademark or Apple Compurar mc. 



FREE INTRODUCTORY 
BONUS 



with. purchase 
of Trak Star 



• Irak Star disk contains patching 
softwote. 

• Simple-to-operate. menu-driven 
Irak Star software automatically 
repairs a bad track without 
requiring technical expertise. 



Midwest 



Phone 913 676-7242 



/MNS, 



ana ncncvinQ cnafoa 

Adapter rsourod for 2-dnve systems 5 1 2 

Documentation onty $3 

[Jefunaatile with purchase of Trak Star 

Personal cheats. MO.. 

Visa and Mastercard 

Microsystems 

9071 Metcall / Suite 124 
Overtcna Park. KS 66212 
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Some protectors have begun to 
bypass the routine which outputs the 
prompt, but you can still guess that 
there's a modified DOS present if the 
boot sounds like a normal DOS boot. 
but the disk won't copy with COPYA. 

To confirm my hunch that Lancaster 
was using a modified DOS, I booted 
one of my normal DOS 3.3 disks and 
put Lancaster in the drive and typed 
CATALOG. The disk drive recalibrat- 
ed and made other obnoxious noises 
and returned the message I/O ER- 
ROR. Not that I was expecting any 
miracles, but why not try? 

Still believing that there was a some- 
what normal DOS present on the disk, 
however, more snooping had to be 
done. 

Let's think about what causes an I/O 
error, for a moment. Whenever any- 
thing goes wrong during disk access. 
■RWTS branches to a routine at SB942 
to set the carry bit and return. The 
other routines in RWTS monitor the 
carry bit and check to see if there was 
a bad data read, a bad address read 
or some other no-no. 

At SB942 there are, simply, two in- 
structions: SET THE CARRY and 
RETURN. 

If we wish to defeat the DOS error 
checking (which we do in this case), 
we can change the SET THE CARRY 
to CLEAR THE CARRY. By making 
this change, you are telling RWTS not 
to check for any errors, assume every- 
thing is alright and go on. 

This, obviously, is not good general 
practice since you are defeating the 
purpose of all the careful error check- 
ing that DOS does. 

But it is great for examining modified 
DOS's. It will handle any changes to 
the epilog bytes or intentional errors in 
the checksum of either field but not in 
the header bytes. (Header changes 
must be done by modifying the ap- 
propriate code in the subroutine). 

With this in mind, we enter the mo- 
nitor with CALL-1 51 andtypeB942:18 
to disable the DOS error checking. 
Now type CATALOG and, gosh! In- 
deed, there is a catalog! 

Now all the files are loadable (or 
BLOADABLE) for further snooping. 

But this is not the end of the protec- 
tion. Examining the HELLO program 
revealed an unusual file named SVS 
and some curious CALLs and POKEs. 
Upon further inspection, I came to the 
conclusion that the file SVS was a 
secondary protection involved in Lan- 
caster. Simply preventing the loading 



continued on page 28 
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Unlocking Bill Budge's 
Trilogy 



By Michael 
Decker 



Trilogy of Games 

California Pacific 

757 Russell Bivd 

Davis, CA 95616 

Requirements: 

48K Apple II plus 

Bill Budge's Trilogy of Games 

A blank diskette 



Background 

One of Bill Budge's earliest offerings 
was his Trilogy of Games: Driver, a 
rudimentary driving-skills game; Pin- 
bail, a rudimentary you-guessed-it; and 
Space Wars, a (I won't say it) two- 
player space battle. 

This old, DOS 3.2 disk still sells and 
Space Wars remains one of the most 
entertaining arcade-style games in 
which two players can directly battle 
each other. Most people often prefer 
it to newer, much more sophisticated, 
games in which one battles the com- 
puter. I was motivated to de-protect the 
game by a slight bug (one player's ship 
is more affected by gravity than the 
other ship) and by my annoyance with 
the game's DOS 3.2 format. 

Inside Budge 

I, first, tried cracking the disk. Pro- 
tection was simple: changes in the pro- 
logues/epilogues. However, it looked 
like direct disk addressing was used. 
Ugh. 

So, I booted with an Inspector/BAS- 
ICS disk, then booted Trilogy. At the 
menu, I reset out, then looked memory 
over: picture at $4000; program at 
$6000. Hmm. 

I, then, booted DOS and saved pic- 
ture and program. Next, I restarted the 
program (*6000G) and, in turn, load- 
ed each game. I found the entry points 
and saved the games. Next, I exa- 
mined the main program and identified 
the transition between the menu and 
the disk access routines. Finally, I 
wrote an Applesoft program to handle 
the game switching. Presto! The 
Transparent Budge! 

Doing It 

1) Boot the DOS 3.3 System Master. 

2) Prepare to boot 13-sector DOS 
JBRUN BOOT13 

3) Insert the Trilogy disk and press 
[RETURN 

4) Hit ESC to get to menu. 

5) Remove the disk and press 
RESET 

6) Press RESET again. 

7) Boot a 48K siave (preferably with 
no "HELLO" program) having around 
150 free sectors. 



]PR#6 

8) Save the picture first 
]BSAVE PICTURE, AS4000,LS2000 

9) Enter the monitor 
]C ALL- 151 

10) Make a modification. 
"67B7:4C D2 D7 

1 1) Save the first 8 pages of this modi- 
fied program 

*BSAVE ATTRACT, A$6000,L$800 

12) Restore the original program 
*67B7:20 00 6D 

13) Insert Trilogy disk and re-start the 
game 

•6000G 

14) Hit ESC to get to menu. 

15) Type 1 to select Driver, the first 
game in Trilogy. 

16) When the title and/or instructions 
come up, hit RESET. 

17) Swap disks and save the just load- . 
ed program. 

]BSAVE DRIVER,AS800,LS1801 

18) Enter the monitor again 
jCALL-151 

19) Repeat steps 13-18 for PINBALL 
AND SPACE WAR. Using the same 
BSAVE parameters 



10 ON PEEK (104) = 112 GOTO 20: 
POKE 103,1: POKE 104.112: POKE 

28672.0: PRINT CHRS (4J-RUN 

8UDGE.HELL0* 
20 PRINT CHRS (4) -BL0AD ATTRACT 

30 PRINT CHRS (4)"BL0AD PICTURE 

# 

40 POKE 10,76: POKE 11,0: POKE 1 

2.96: PRINT USR (0): CALL - 

10621 
50 OS = CHRS (13) + CHRS (4): VTA8 

1: ON PEEK (67) - 3 GOTO 60 

,70.80 
60 PRINT DS-BLOAD DRIVER": CALL 

3523: RUN 40 
70 PRINT OS-BLOAD PINBALL": CALL 

2048: RUN 40 
80 PRINT DS-BLOAD SPACE WAR': CALL 

6015: RUN 40 



20) Goldstar! BASIC and DOS 
*FP 

21) Type in the BASIC menu driver 
program listed above. 

22) Save it 

]SAVE BUDGE.HELLO 

I would sometimes get an ?OUT OF 
MEMORY ERROR. If you should en- 
counter this, just RUN 20 each time 
and you'll be fine. 

Now, would someone tell me how to 
make both spaceships feel the same 
gravity? 



^ 



DEAR AUTHOR: 

Would you like to be published in 
HARDCORE COMPUTIST? We would 
like to hear from you. 

HARDCORE COMPUTIST wel- 
comes articles and submissions on a 
variety of subjects of interest to users 
of the Apple (or compatible) computers 
and would like to publish well-written 
material on the following: 

' Soft keys * Hardware Modifications 
' Advanced Playing Techniques 

* DOS modifications * Utilities 

* Product reviews * Adventure Tips 

* Original programs of interest 

* Do-it-yourself hardware protects 

* General interest articles 

* Bit-Copier Parameters 

We prefer to see your submission on 
a DOS 3.3 disk using an Apple (or 
compatible) editing program. Please 
enclose a double-spaced hardcopy 
(paper) manuscript, using a dot-matrix 
or letter-quality printer (or typewriter). 
Submissions will be mailed back if 
adequate return packaging is included. 

HARDCORE COMPUTIST pays on 
acceptance. Rate of payment depends 
on the amount of editing necessary 
and the length of the article. Payment 
ranges between $10 for a short soft- 
key and $50 per typeset page for a full- 
length article. We pay more for soft- 
keys if the original, commercial disk is 
enclosed for verification. We guaran- 
tee the disk's return. 

Soft key Publishing buys aU rights as 
well as one-time reprint righUa (for up- 
coming BEST OF HARDCORES) on 
general articles and exclusive rights 
on programs. We may make alternate 
arrangements with individual authors, 
depending on the merit of the contri- 
bution. 

At present we are not accepting fic- 
tion or poetry submissions, but HARD- 
CORE COMPUTIST may make an 
exception for an outstanding 
computer-related short story or poem. 

For a copy of our Writer's Guide, 
send a business-sized (20-cent) SASE 
(self-addressed, stamped envelope) to: 

hardcore COMPUTIST 

Writer's Guide 

P.O. Box 44549 

Tacoma, WA 98444 
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FIXING 

BAG 



Bag of Tricks 

Quality Software 

6660 Reseda Blvd., Suite 105 

Reseda, CA 91335 

$39.95 

Requirements: 

Apple II, II Plus, lie or compatible 

Blank disks 

DOS 3.3 Master 

Backup disk created using 

Neal Taylor's "Softkey for Bag of 

Tricks"(see HARDCORE COM- 

PUTIST#3) 

Bag of Tricks original disk 

Introductory 

Having spent considerable effort un- 
locking the Bag of Tricks at an earlier 
time, I was very interested to read Neil 
Taylor's simpler procedure for obtain- 
ing an unlocked backup in HARD- 
CORE COMPUTIST #3. I used his 
technique only to discover that it does 
not produce a completely functional 
copy. 

I, then, developed the procedure 
described below which, along with Neil 
Taylor's article, allows the reader to 
produce the desired unlocked, fully- 
functional backup copy. His procedure 
is straightforward and easy but, 
perhaps, it is just a little too easy. 

What follows is a way to clean up the 
loose ends in his softkey. 

The Problem 

Actually, that softkey does not quite 
produce an unlocked, fully-functional 
copy of the original. After using the 
procedure described in that article and 
examining the resulting files, I disco- 
vered that an important link was 
missing. 

For an eye-opener, load the HELLO 
program and delete line 110. Now, 
RUN the modified HELLO program 
and, when the menu appears, select 
ZAP, INIT or FIXCAT. The chosen pro- 
gram will be loaded and run but 
without the SUPPLEMENT program. If 
you try out the programs you will find 
that they run equally well without the 
SUPPLEMENT as with it. 

Why, then, is the SUPPLEMENT 
needed? The answer comes when 
DOS 1 3 or CP/M or Pascal modes are 
selected while using the programs. No 
format other than DOS 16 (DOS 3.3) 
is supported without a properly func- 
tioning SUPPLEMENT program. 

What's In a Supplement 

The main programs (ZAP, INIT, FIX- 



THE SOFTKEY FOR 

OF TRICKS 



By Earl Taylor 

CAT and TRAX) access the RWTS 
{Read or Write a Track/Sector) rou- 
tines in their SUPPLEMENTS through 
locations in the Apple's page 3 of 
memory. 

Using the method given in HARD- 
CORE COMPUTIST #3, these loca- 
tions connect normal DOS's RWTS 
routines to the main program so that 
they work fine with normal DOS 3.3 (16 
sector) diskettes. 

The other formats, however, require 
different RWTS routines and these are 
only available in the SUPPLEMENTS. 



6) Press reset once, wait a second 
and press reset again to shut the drive 
off 

7) Type CALL-151 to enter the mo- 
nitor and, when the asterisk appears, 
type the following: 

6) 5400 < 9400. 96 FFM 
9) 5485:55 

10) 5517:55 

11) 5530:55 

12) 5542:56 




Although loaded into memory, the 
SUPPLEMENTS have been left "un- 
con needed" to the main programs. To 
correct the problem we need to fix the 
page 3 locations to properly connect 
the SUPPLEMENTS. 

Getting the Third Page 

1) Boot the DOS 3.3 Master disk 

2) Type FP and put a blank disk in 
the drive 

3) Type INIT HELLO 

4) Insert the original Bag of Tricks 
disk in drive 1 and boot it up 

5) When the menu appears and the 
drive light goes off, open the drive door 



13) 554A:56 

14) Insert the disk INITed in step 3, 
above, and type 

C600G 

15) When the disk has booted 
BSAVE FIXPG3,A$5400,L$300 

16) Using FID from the DOS 3.3, 
Master disk, transfer the FIXPG3 file 
to the disk made according to the arti- 
cle in HARDCORE COMPUTIST #3 

17) Change the HELLO program on 
the backup disk to the one listed 

below. 
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PROGRAM 



10 

20 
30 

40 
50 



60 
70 

80 



90 



100 A$ 



110 

120 

130 

140 

150 

160 
170 



180 
190 



200 
210 



TEXT : HOME : HIMEM: 25600 
IF PEEK (104) = 96 THEN 50 
POKE 103,1; POKE 104,96: POKE 

24576,0 
PRINT CHR$ (4);"RUN HELLO" 
A m PEEK ( - 16384) - 128: IF 

A = 70 OR A = 73 OR A = 84 OR 

A = 90 OR A = 69 THEN 100 
POKE - 16368,0 
HTAB 10: VTAB 10: PRINT "LOAD 

ING MENU ..." 
PRINT CHR$(4);"BLOAD PICTUR 

E,A$4000": POKE - 16299,0: POKE 
- 16297,0: POKE - 16302,0: 
POKE - 16304,0 
IF PEEK(- 16384) < 128 THEN 

90 

CHR$ ( PEEK ( - 16384) - 

128): POKE - 16368,0 

IF A$ = 'T"THEN A$ = 'TRAX" 
0: GOTO 170 
= "Z"THEN A$ = "ZAP": 

A = 2: GOTO 170 

IF AS = T'THEN A$ 

:A = 1: GOTO 170 

IF A$ = "F" THEN A$ = "F1XCA 

T":A = 3: GOTO 170 

IF A$ = "E"THEN TEXT : HOME 

: END 

GOTO 90 

TEXT : HOME : VTAB 11: HTAB 

((13 +' LEN (AD)/ 2): PRINT 

"LOADING ";A$;"..." 

D$ == CHR$ (4) 

IF A$ = "TRAX" THEN PRINT D 

$;"BL0AD TRAX.SUP,A$87O0": GOTO 

210 

PRINT D$;"BLOAD SUPPLEMENTS 

$7600" 

PRINT D$;"BL0AD ";A$;",A$800 



:A - 
IF A$ 



"I NIT" 



220 PRINT D$;"BLOAO FIXPG3,A$540 

0" 
230 POKE 47016, PEEK (43): POKE 

38079,A: CALL 21635 



That's it. The resulting disk should 
now contain the new FIXPG3 file and 
the new HELLO program, along with 
the ZAP, INIT, FIXCAT, TRAX, 
TRAX. SUP, SUPPLEMENT and PIC- 
TURE files from before. 

This disk now supports all the for- 
mats of the original disk and has a cou- 
ple of other features as well. 

First, if you hit the key for your 
choice of the main program soon 
enough (during the loading of the HEL- 
LO program), the loading of the menu 
will be skipped and the desired pro- 
gram will be run immediately. 

Secondly, the "E" key will exit the 
menu to Applesoft with normal DOS. 



How it Works 

The original Bag of Tricks uses a 
routine at $9483 to set up page 3 to 
connect the main program and the 
SUPPLEMENTS. It copies an image 
from page $96 into page 3 and, then, 
patches in the boot slot #, 

If TRAX is being used, it makes a 
patch to compensate for the different 
SUPPLEMENT program then it resets 
the system stack and jumps to the start 
of the main program. 

In order to use this routine at $9483, 
steps 1 through 15 follow the same 
general method used in the original ar- 
ticle. But, before the program is saved, 
it is moved to page $54 (step 8) and 
patched, to allow it to run at this loca- 
tion (steps 9 to 16). This is necessary 
since it cannot be loaded back into its 
original location without conflicting with 
standard DOS. It is, then, saved and 
added to the other programs on the 
backup disk in steps 14 to 16. 

New HELLO Program 

In order to use the FIXPG3 program, 
a new HELLO program is required. It 
functions as follows: 



Lines 10 to 40 cause the HELLO 
program to reload itself between $6000 
and $6500 to avoid conflicts with the 
other programs which are loaded later 
on. 

Line 50 skips the loading of the 
menu if a correct menu choice is wait- 
ing at the keyboard. 

Line 60 clears any incorrect key 
watting at the keyboard. 

Lines 70 and 80 load the menu into 
the second hi-res graphics page and 
display it. 

Lines 90 to 1 60 get the user's choice 
of program, setting A$ to the program 
name and A to a value from to 3, de- 
pending on the choice made. 

Lines 170 to 210 load the chosen 
program and its required SUP- 
PLEMENT. 

Line 220 loads the FIXPG3 program 
at $5400. 

Line 230 puts in the boot slot # (from 
location $2B) and POKEs it to where 
FIXPG3 expects to find it. The user's 
choice (A = 0, 1 ,2 or 3) is also put where 
FIXPG3 needs it. A call to FIXPG3, 
then, starts the whole process running. 



An Almost Exact Backup 

Finally, for those who want an es- 
sentially identical copy of the original, 
I present the following method, using 
Locksmith 4.1: 

1) Copy track using normal 
parameters 

2) Copy tracks 1 to 15 with these 
parameter changes: parm 44 = D6, 
parm A6 = D6 and parm A8 = B5 

3) Boot up ZAP from the original Bag 
of Tricks disk, then, place the copy 
disk in the drive 



4) Enter the following 


ZAP 


commands: 




R0,0 




41:A94C 




43:8D3C03 




46:A953 




48:8D3D03 




4B:A902 




4D;8D3E03 




50:4C0103 




53:A960 




55:8DA0BE 




58:4C0OB7 




41 I 




You should see: 




$5041: LDA #$4C 




$5043: STA $033C 




$5056: LDA #$53 




$5058: STA $033D 




$505B: LDA #$02 




S505D: STA $033E 




$5060: JMP $0301 




$5063: LDA #$60 




$5065: STA $BEA0 




$5068: JMP $B700 




$506B: BRK 




etc. 





If it is not correct, go back to step 4 
and correct any errors you may find. 

But if it is correct, type UNLOCK 
WRITE. The resulting copy will func- 
tion exactly like the original, including 
the fast load up. 

The copy is, of course, still protect- 
ed from normal COPYA copying but 
can be bit-copied using just steps 1 
and 2, above. 



A Stitch in Time 

At this point, I would like to recom- 
mend using one of the faster DOS's 
such as DiversiDOS, DOSBoss, Pron- 
toDOS, etc. to speed up the loading of 
the programs. Using normal DOS with 
the backup is painfully slow, compared 
to the original, protected disk. 
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Checksums 


10 


- $B8F0 


130 


- $1B94 


20 


- $1FBC 


140 


- $FCC4 


30 


- $AB48 


150 


- $4FB8 


40 


- $249F 


160 


- $F571 


50 


- $9A28 


170 


- $GCFC 


60 


- $01 CO 


160 


- $4EA1 


76 


- $EBFE 


190 


- $8928 


80 


- $618B 


200 


- $15BE 


90 


- $F578 


210 


-$A77C 


100 


-S866F 


220 


- $D77D 


110 
120 


- $9869 

- $24B4 


230 


- $CF26 fit 
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Egbert Software 

W.H. Nail Co. 

275 Lodgeview Drive 

Orovilie, CA 95965 

(916)589-2043 

$69.95 

Requirements: 

Apple II Plus, lie, or compatible 
DOS 3.3 Master Disk 
Egbert II Communications Disk 
MUFFIN program 
Blank disk 

Since I haven't read anything about 
the Egbert II disk, other than the ad 
marketing it. I'll assume that not too 
many people are aware of the ingeni- 
ous ideas that are packed into this sys- 
tem disk. 

But before I show you how to crack 
and modify the disk, I'll describe and 
explain the system a bit. This is only 
a very brief review and isn't meant to 
be comprehensive. The disk is chock 
full of pleasant surprises. 

The Egbert II Communications disk 
contains three very powerful main 
programs. 



The CW (Morse Code) program will 
decode or send Morse Code at rates 
from three to 125 words per minute. It 
is a great teacher for those interested 
in learning Morse Code or you can sim- 
ply eavesdrop on radio hams. 

Both the RTTY and CW programs 
use the on-board speaker-to-monitor 
arrangement. 

The Transfer program will work just 
as well with any transceiver, or you can 
transfer programs over the telephone 
without a modem! All you need is a 
cheap amplifier (Like the Radio Shack 
277-1008 which costs $11.00) and a 
telephone pick-up coil (also available 
at the 'Shack for about $2.00). It sure 
beats the price of a Modem! 

Now that your mouth is watering at 
the possibilities of getting the news 
and listening in on private and govern- 
ment teletype communications without 
messing around with any extra hard- 
ware, order one! 1 heartily recommend 
this disk. It's worth every penny. 

But once you have the disk you will 
find some unfriendly little annoyances 
programmed-in there. 



Cracking The Egbert II 
Communications Disk 
(RTTY/CW/TRANSFER) 

By Keith S. Goldstein, M.D. 



The RTTY (Radio Teletype) program 
receives and transmits radio teletype 
signals. It generates RTTY tones on 
transmit and decodes the RTTY tones 
on receive. Some other goodies it has 
are a "Mailbox" option and an audio 
frequency counter option. 

The CW (Continuous Waves) pro- 
gram does the same for Morse Code, 
while the Transfer program allows you 
to send and receive Applesoft, Integer 
and Binary programs over the tele- 
phone or radio. 

The special attraction is that all of 
the tone generation and decoding is 
done from within the program, so there 
is NO HARDWARE INTERFACE RE- 
QUIRED! 

The cassette I/O plugs are used 
from the rear of the computer. Simply 
plug the cassette input into the speak- 
er/earphone jack of any communica- 
tions receiver (or telephone amplifier 
for the Transfer program) and plug the 
cassette output into the microphone 
jack of the transceiver. That's all you 
need to send/receive RTTY or CW. 

For the non-amateur radio opera- 
tors, you can use the RTTY program 
to receive foreign and domestic wire 
news services and telegrams such as 
those supplied by UPI. 



Haven't you ever wished that you 
could go from receive to transmit 
RTTY without that dam CW (Morse 



Code) identifier breaking your concen- 
tration? Doesn't having your name and 
serial number flashed at you constant- 
ly annoy you? Wouldn't you just love 
to have the programs load super fast 
by using a speedy DOS? Wouldn't you 
like to be able to modify the programs 
to your heart's content? Wouldn't you 
just like to have a backup copy and 
don't have a nibble-copier? 

You can find how to do these things 
and more below. 

The Lock 

The Egbert II Communications Disk 
uses several simple and yet very effec- 
tive tricks to prevent the user from dis- 
covering its secrets. 

The major copy-protection scheme 
it incorporates is its DOS and the way 
the disk is initialized, ft won't allow any 
standard copy programs or nibble- 
copiers (without changing parameters) 
to duplicate it. To unprotect the pro- 
grams on the original disk, each one 
must be loaded by the Egbert DOS 
and saved by a normal DOS onto a 
standard disk. After you have trans- 
ferred the programs they will all, even- 
tually, bomb into the monitor because 
the author included some checking 
routines to be sure that you are using 
his custom DOS. We will defeat those 
routines too. 

The author was quite thorough in his 
protection scheme. It is impossible to 
stop the computer, by using reset or 
any normal method. Egbert DOS is a 
standard 3.2 with many modifications 
and patches. The author patched over 
the I NIT command with his own rou- 
tines. Among other things, this patch 
will set the Run Flag ($D6) to FF and 




disable the CATALOG, INT, and FP 
commands at every disk access (pret- 
ty shrewd, eh?) 

Also, since the programs must ac- 
cess normal DOS disks. Egbert has 
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the normal DOS routines loaded and 
moved into place immediately after 
any of the programs have been load- 
ed. This makes it impossible to use the 
resident DOS to access the Egbert 



7) Relocate the first chunk of code 
• 1 900 < B80Q.BA1 < Ctrl > Y 




disk for the purpose of transferring the 
programs once any of them starts 
running. 

These problems can be solved by 
using a modification of the DOS 3,3 
Master Disk program called MUFFIN. 
The modified MUFFIN has come to be 
called DEMUFFIN PLUS. 

As you recall, MUFFIN is a machine- 
language program which will transfer 
programs or files from DOS 3.2 to DOS 
3.3. In general, it reads from one disk 
format and writes to a different disk for- 
mat. The modification to MUFFIN al- 
lows it to use whatever DOS is present 
in the machine to read from the locked 
disk and to write the file out onto a 
standard DOS 3.3 disk. This gem is 
just what is needed to transfer the Eg- 
bert files to a DOS 3.3 disk. 

If you already have DEMUFFIN 
PLUS, you can skip this entire section 
on how to create the program and be- 
gin to break the disk at step 1. 

How to Create 
DEMUFFIN PLUS 

1) Boot DOS 3,3 Master to load In- 
teger BASIC 

2) Enter the other BASIC 
11NT 

3) Load the MUFFIN program 
>BLOAD MUFFIN 

4) Enter the monitor 
>CALL-151 

5) Initialize the Programmers Aid 
relocation feature 

•D4D5G 

6) Tell the monitor what is being 
moved and where it is going 

■ 1 900 < B800.BFFF < Ctrl > Y * 



8) Move the data segment 
•-BC57M 

9) Relocate the rest of the code 
•.BFFF<Ctri>Y 

1 0) Make the following modifications 
to MUFFIN and the relocated RWTS 
subroutine 

•1155:00 1E 

■11SB:D9 03 

• 1197:A0 20 

•15AO:A0 D2 C5 03 C9 C4 C5 CE 

- 15A8:D4 AO C4 AE CF AE 03 AE 

■15F7:C4 C5 

•20AO:A9 IE 8D B9 B7 20 FD AA 

•20A8:48 A9 BO 80 B9 B7 68 60 

1 1) Save this new code 

•BSAVE DEMUFFIN PLUS, 

AS803.LS1900 

You now have a copy of DEMUFFIN 
PLUS, a powerful utility which can be 
used for other cracking projects. 

The Egbert files can now be trans- 
ferred. 

The Softkey 

Here are the steps to follow in order 
to transfer the files to a standard DOS 
3.3 disk: 

1 ) Boot the system master and for- 
mat a blank disk 

jINIT HELLO 

2) Delete the HELLO program 
{DELETE HELLO 

3) Load DEMUFFIN PLUS in a safe 
place where the boot won't mess it up 

]BLOAD DEMUFFIN PLUS.AS6000 

The Egbert DOS will "lock you out" of 
the machine once it is loaded, so we 
will have to allow the Egbert DOS to 
load in and then we will have to stop 
it before it initializes itself (i.e: takes 
over). This can best be done by a tech- 



nique called Boot-Tracing. The 
process takes a little time but the satis- 
faction and knowledge gained is well 
worth the effort. 

In general, this technique involves 
loading a chunk or stage of the boot 
into memory, examining it, moving it 
to a safe place in RAM, modifying it to 
work at the new location and stopping 
the boot (after loading each new stage) 
so that we will always be in control of 
the computer. In this way, the Egbert 
DOS can be allowed to fully load itself 
and then be forced to halt. 

4) Put the Egbert disk in Drive 1 , Slot 
6 and enter the monitor 

JCALL-151 

5) Move the bootcode in the con- 
troller card to RAM 

•B600<C600.C6FFM 

6) Make the moved bootcode JuMP 
into the monitor after loading track 0. 
sector 

•86F8:4C 59 FF 

The Drive will stay on for the remainder 
of this process. 

7) Move the first boot stage to a new 
location 

•8000< 80Q.9FFM 

8) Now we must change a few loca- 
tions so it will work at this new location 

• 8003:BO 00 80 

9) Make this new stage JuMP into 
the monitor when finished 

•8049:4C 59 FF 

10) Now we have to tell the first 
stage where our new second stage has 
been moved to 

■86F8:4C 01 80 

11) Load the third stage of the boot 
•8600G 

12) Since the last stage ended with 
a JuMP to location $301, we know 
where this third stage of the boot was 
just loaded. To be certain that it won't 
be over-written by the next stage, we 
will move it to a safe place 

•8300<300.3FFM 

13) Now, again, we have to change 
a few locations so that this stage will 
function properly at this new location 
in memory 

•8313:AO CC 83 
•833C:AO CC 83 

14) The jump out of the fourth stage 
is not immediate but only after many 
jumps to a certain subroutine does it 
continue on to the next stage of the 
boot. Therefore, we'll place a short 
program for this stage to jump to. We 
will also check it to see if it is going to 
the subroutine again (and if so, let the 
program continue) or if not, then stop 
and JuMP into the monitor. We will 
place our little program at $8400 but 
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we need to intercept the program to 
JuMP to our little routine. 
*6343:4C 00 84 

15) Enter this little routine 

•8400: AS 3E C9 D5 DO 03 6C 3E 00 4C 
59 FF 

1 6) Now we mustn't forget to let our 
stage three know where this stage four 
was moved to so that it will be able to 
continue to load another chunk of the 
DOS for us 

•8049:4C 01 83 

1 7) At this point we will let the com- 
puter use all of our routines to load in 
stage four of the boot 

•8600G 

18) Now we've got almost all of the 
DOS loaded. Let's see where the final 
stage has been loaded 

•83CC 

The number you should see is $B6. 
Add 1 to it ($B6+ 1) = SB7O0 there- 
fore, our next JuMP will be to $B700. 

19) Since we know where this last 
portion has been loaded, we are ready 
to complete the boot and have it stop 
just before it begins to start up the 
DOS. Let's move this fourth stage out 
of the way. 

•5700<B700.BFFFM 

20) Now, we see the familiar DOS in- 
itialization routine JuMP near the be- 
ginning of all this stuff we have just 
moved. Once it has finished loading it- 
self into the machine, let's have it 
JuMP into the monitor instead of start- 
ing the EGBERT DOS 

■5747:4CS9 FF 

21) We also must not forget to let the 
previous third stage boot know where 
we have moved this final stage to 

•8409:4C 00 57 

22) We are. now. ready to allow the 
entire EGBERT DOS to be read into 
the machine and it will stop just before 
it can take control, which is exactly 
what we want! 

•8600G 

The disk will stop spinning now since 
the boot has finished 

23) Since we stopped the EGBERT 
DOS from being able to initialize itself, 
it wasn't able to fill-in its page-3 vec- 
tor table. In order for our previously en- 
tered DEMUFFIN PLUS to function, it 
needs these vectors intact. This can be 
easily accomplished since the page-3 
vector table image already exists wi- 
thin the Egbert DOS image. Just move 
it to page 3 

•3D0<9E51.9E7EM 

24) Move the DEMUFFIN PLUS pro- 
gram back to $803 and start it running 

•803<6000.8QQOM 
•803G 



25) Select Convert Res from the 
menu. For "File Name?" enter "»" 
(The Wildcard character). Transfer all 
files from the onginal disk to the stan- 
dard initialized DOS 3.3 disk. 

Do not attempt to transfer seven of 
those files shown in INVERSE as they 
are DUMMY FILES and will cause er- 
rors if you try to copy them. 



Fixing the Files 



Now that you have all of the pro- 
grams on a standard DOS 3.3 disk, 
you are ready to remove the checks for 
the non-standard DOS so they will 
function correctly. Most of the changes 
that will be made will remove a POKE 
214,255. This sets the Run Rag. 

26) Boot your DOS 3.3 Master Disk. 
Remove it and insert your new Egbert 
DOS 3.3 disk 

27) Modify the HELLO program 

JLOAD HELLO 

2 INVERSE : FOR I = 1 TO 40: PRINT 

•®-\: NEXT : VTAB 15: FOR I = 
1 TO 40: PRINT *@';: NEXT : FOR 
I = 2 TO 14: VTAB I: HTAB 1: 
PRINT •©';: HTAB 40: PRINT 
"®"\: NEXT : NORMAL : VTAB 3 
: HTAB 7: PRINT "EGBERT C0MM 
UNICATI0NS DISK*: PRWT 
]SAVE HELLO 

28) Modify the MAIN program 

]LOAD MAIN 

8010 VTAB 3: HTAB 7: PRINT "EGBE 
RT COMMUNICATIONS DISK': VTAB 
5: HTAB 16: PRINT "MAIN MENU 
■: RETURN 

]SAVE MAIN 

29) Modify the RTTY program 

]LOAD RTTY 

3 B$ - CHRS (4): G0SUB 91: VTAB 

16: HTAB 11: FLASH : PRINT ' 
LOADING PROGRAMS": NORMAL :D 
$ = CHRS (219):ES = CHRS ( 
221): PRINT B$:*BL0AD COMBO 
1 ^8-83,01 ': PRINT BS; "BL0AD 
SPL,D1* 

79 TEXT : HOME : PRINT "BYE!': PRINT 
CHRS (7): END 

85 0NERR GOTO 73 

]SAVE RTTY 

30) Modify the ECW program 

]LOAD ECW 

30 POKE 115.0: POKE 116,147 POKE 

111,0: POKE 112,147 
110 REM 
120 REM 
200 REM 
ISAVE ECW 

31) Modify the XFER program. 
]LOAD XFER 

135 REM 
137 REM 
]SAVE XFER 



32) Modify the TRANSFER] 
program. 

jLOAD TRANSFER] 

675 REM 

1035 REM 

2011 REM 

2020 REM 

2030 REM 

2040 REM 

2050 REM 

2060 REM 

2070 REM 

2080 REM 

]SAVE TRANSFER] 

33) Modify the BUFFER/MESSAGE 

program 

JLOAD BUFFER/MESSAGE 

145 REM 

150 REM 

220 VTAB 23: PRINT THIS WILL TA 

KE ABOUT 90 SECONDS *: VTAB 

17 
225 REM 
]SAVE BUFFER/MESSAGE 

34) Modify the COMBO 1-8-83 
program 

]BLOAD COMBO 1-8-83 

This program checks for the non- 
standard patch to the CATALOG com- 
mand on the locked disk. It checks for 
a $60 in the DOS. If it is there, the pro- 
gram continues. If it isn't there, the 
RTTY program bombs. The normal 
DOS 3.3 value is a $20. To enable it 
to work perfectly with DOS 3.3, one 
change is required which makes the 
check routine look for the normal DOS 
3.3 value of $20 instead of the $60. (in- 
cidentally, the $60 of the non-standard 
DOS disables the CATALOG com- 
mand; it causes the command CATA- 
LOG to be ignored). The change is as 
follows: 

]CALL -151 

• 54BC:20 

•BSAVE COMBO1-8-83.AS5000.LS0AD5 

35) Fix the same CATALOG patch 
in the RCV program 

•BLOAD RCV 

• 414E:00 00 

• BSAVE RCV.AS4000.LS58B 

36) Fix the CATALOG patch in the 
XMT program 

•BLOAD XMT 

•52C2:20 

•BSAVE XMT.AS5000.LS3E8 

37) Delete the image of DOS 3.3 on 
the disk 

• DELETE DOS 3.3 

38) Remove the DOS mover from 

the disk 

•DELETE DOS MOVE 3.3 

You now have a fully functional DOS 
3.3 version of the entire EGBERT 
RTTY/CW/TRANSFER system to cus- 
tomize at your discretion. 
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For starters, here is how to obliter- 
ate the serial number of the diskette. 

]LOAD RTTY 

91 HOME : INVERSE : FOR I = 1 TO 
40: VTAB 1: PRINT *@" CHR$ ( 
8);; VTAB 7: PRINT •©";: NEXT 
: FOR I = 2 TO 6: VTAB I: HTAB 
1: PRINT -®"\: HTAB 40: PRINT 
"@": NEXT : NORMAL : VTAB 3: 
HTAB 9: PRINT "EGBERT II RT 
TY PROGRAM': HTAB 9: PRINT " 
WRITTEN BY G.W. EGBERT': HTAB 
14: POKE 34.7: RETURN 

Type in the following in immediate ex- 
ecution mode: 

]F2 = PEEK(1 75) + PEEK(1 76) • 256-8:FOR 
AT = 1 TO 4:POKE F2+A.0:NEXT 
]SAVE RTTY 
LOAD ECW 
260 REM 
370 REM 

Again in immediate execution mode 

type: 

]F2 = PEEK(1 75) + PEEK(1 76)- 256-8:FOR 

AT = 1 TO 4:POKE F2 +A,0:NEXT 

]SAVE ECW 

JCALL-151 

• BLOAD COMBO 1-8-83 

•50D2:FF 

-50D3- 50D2.5DE8M 

•BSAVE COMBO 1 -8-83, AS5000.LS ADS 



• BLOAD RCV 
-414E:0O 

• 414F<. 414E.415BM 
•415C:FF FF 

•BSAVE RCV,AS4000,LS58B 

To aid you in you customizing, here 
is a list of programs and a brief 
description. Have fun! 



^ 



HELLO - Boot-up title. 

MAIN - Main menu. Uses PRINT SETT, 
BUFFER/MESSAGE, CODE, MES- 
SAGE. OBJ, CODE, RTTY, ECW. 
XFER files. 

RTTY - RTTY program body, uses 
COMBO 1-8-83, SPL files. 

COMBO 1-8-83 - RTTY machine lan- 
guage portion. 

SPL - Printer spooler machine lan- 
guage portion. 

PRINT SET - Printer set-up program. 
Uses SPL. 

ECW - CW program body. Uses XMT, 
RCV. SPL, GP files. 

XMT - CW transmit machine language 
portion. 



RCV - CW receive machine language 
portion. 

GP - CW game paddle overlay in 
machine language. 

CODE - Contains the number of pro- 
grams on the disk. 

XFER - Transfer title and set-up 
program. 

TRANSFER] - TRANSFER program 
body. Uses XFER 3800. 

XFER 3800 - TRANSFER machine 
language portion. 

BUFFER/MESSAGE - Buffer/message 
program. Creates messages, prints 
the buffer; uses MESSAGES. MES- 

S AG E.OB J files. 

MESSAGE - Message program. Not 
copy-protected on original disk. Uses 
MESSAGE.OBJ file. 

MESSAGE.OBJ - Contains the canned 
messages and saved files. Not locked 
on the original disk. 

DOS 3.3 - Overlay of standard DOS 
3.3. 

DOS MOVE 3.3 - Relocates DOS 3.3 
and overwrites the Egbert DOS with 
standard DOS 3.3. 



DISK PREP 

Get the most out of both sides of your 
diskettes. 

Be confident your data will be there 
when you need it. 

DISK PREP is a software utility to certify 
Apple ][ diskettes. The program uses worst 
case pattern testing and bad sector lock- 
out to ensure that you get the best use out 
of both the front and the back of a diskette. 

Instructions on using the backs of dis- 
kettes are included. ~ 

DISK PREP is compatible with 40 track 
disk drives. 

$25.00 



sympathetic software 

9531 -H Telhan Drive 

Huntington Beach, CA 92646 

California Residents please add sales tax 



see* 



I/O 




OHShhhh- 

YOU NEED T|-|E 

Now the tun begins' With the 
CIA (Confidential Information 
Advisors) on the trail of your 

disks, fixing those I/O ERRORS is really fufll Sut repairing 
clobberred disks quickly and easily is actually just the 
beginning. The CI A is a collection of five advanced disk utilities, 
working together to investigate, edit, locate, list, trace, rescue, 
translate, patch, repair, verify, examine, protect, unprotect. 
analyse encrypt and decrypt programs or text files on normal 
and even protected disks, be they DOS, PASCAL, or CPM' As 
you can see this is no ordinary bag ol tricks! It is, in (act a new 
generation disk utility that goes lar beyond anything else 
offered so far. 

But best ol all. you don't have to be a member of the Glared Eye 
Brigade to make full use ol every one ol these sophisticated and 
unique Features We include a copy ol the top secret CIA Files', 
a 1 20 page easy to follow , nana hotdi ng tutorial about the Apple 
(R) disk and the five CIA utilities Everything you need to know 
about disk patching, repair, formatting, protection, and 
encoding is explained in plain English' 

We're betting that within a few days of receiving the CIA Kit. 
you'll be TRYING to clobber a disk - just to have the lun of 
putting it back together' You'll enjoy a new confidence with 
your data storage 

To get ALL FIVE utilities PLUS The CIA Files', for use with 
Apple (R> 1 1 ♦rile. 48K. 1 or 2 dnves fend 165.00 Money Ord«r 
(Chacfci. ■How iim* to dnrl NOT COPY 
crwfci ciwiuiKHiK« PROTECTED 

fel« D*pt. H5 GOLDEN DELICIOUS SOFTWARE LTD., 
350 Filth Avenue. Suite 3308, N*w York. NY 10001. 
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Starcross 
Infocom Inc 
55 Wheeler St 
Cambridge, MA 02138 
$39.95 

Requirements: 

Starcross disk 

Sector Editing program such as 

Diskedit 

One blank disk 



STARCROSS IOB program which ac- 
companies this article. 

Making a Copy of Starcross 

1) Type in and save either the sin- 
gle or dual-drive version of the STAR- 
CROSS IOB program. 

2) Run the STARCROSS IOB pro- 
gram to copy the original disk. It you 
are using the single drive version it will 




BACKING-UP STARCROSS 



By Jeff Rivett 

Having just completed Starcross, I 
can say with certainty that it is one of 
the finest text adventures I have ever 
played. The puzzles are very logical 
and, although some are quite difficult, 
they can still be mastered by pure 
reasoning. 

In other words, you don't have to 
rely on luck to win the game. 

You don't have to rely on luck to 
make a successful copy, either. The 
entire game program uses only tracks 
$0 through $18 (0-24). Track is not 
protected The protection scheme on 
the remainder of the disk is to change 
the start-of-data marks, normally D5 
AA AD, to D5 AA BC. 

When a disk is protected by chang- 
ing the data and address marks, an 
IOB program is often the best copy so- 
lution. 

IOB stands for Input/Output control 
Block, a table of parameters used for 
disk access by the RWTS (Read or 
Write a Track and Sector) subroutine 
in DOS. The RWTS allows you to ac- 
cess the drive directly. The IOB pro- 
gram guides the RWTS as it reads 
from and writes to the tracks and sec- 
tors on a disk. 

An IOB program needs an accesso- 
ry subroutine called a Controlling 
Subroutine (or Controller) to make it 
specific for the program to be copied. 
The Controller indicates to the RWTS 
the specific tracks to be copied and 
when to read and write. For more in- 
formation on the IOB and RWTS, refer 
to pages 94-98 of The DOS Manual. 

To make a back-up copy of Star- 
cross you will need to use either the 
single or dual drive version of the 



instruct you when to remove and insert 
the proper disks. Note that your drive 
will make noise when reading track 2, 

but this does not affect the perfor- 
mance of your copy in any way. 

3) When the IOB copy is completed, 
remove your original copy of Starcross 
from the drive and place it in a safe lo- 
cation. 

4) Get out your sector editing pro- 
gram and make the following changes 
on track 0, sector 2. 

Trk Set Byte From To 

2 FC BC AD 

2 5D BC AD 

The first modification allows the pro- 
gram to read the copied disk and the 
second one allows the save game rou- 
tine to write to a normal 3.3 disk. 

5) Write the track back to the disk 
and you have a deprotected version of 
Starcross. 

The copied version of Starcross can 
now be booted from slot 6. 

Backup for Other Infocom Games 

The method I have described above 
will also work on other Infocom games. 
The same STARCROSS IOB program 
will copy Zorks I and II without any 
modifications. By modifying the pro- 
gram to copy all tracks through 28 
($1C) it will also copy Zork III, Sus- 
pended and Pianetfali. If you are us- 
ing the single drive version change line 
1007 to read: 

1007 FOR LO = 1 to 28 step 6 



Likewise for the dual-drive version 
change line 1010 to read: 

1010 FOR LO = 1 to 28 

The same sector modifications that 
were done to the copy of Starcross are 
also necessary to backup these other 
Infocom disks. 

Adding Your Own Text 

Infocom programs don't use normal 
text files for program text. Instead, bi- 
nary information is read directly off the 
disk into memory, where some strange 
and wonderful alterations are per- 
formed to make it look like text to you 
and me. 

When a sector editing program is 
used to look at the copy disk, only the 
error message and the SAVE and RE- 
STORE prompts are visible. If the text 
were decoded, it would be possible to 
add your own messages and personal- 
ize your copy. 

But this isn't easy. After experiment- 
ing with my Starcross IOB copy for a 
while, I realized that the coding is prob- 
ably not just a straight byte-for-ASCll- 
byte mapping. In fact, some values 
may represent whole words. I also sus- 
pect that a checksum is used on all 
text data, because even the slightest 
change can cause the program to 
bomb. 

Although you may find that decod- 
ing the text in Starcross is quite a 
challenge, you now have the peace of 
mind of a backup copy on which to 
practice. 

In turn, your new IOB copy can be 
duplicated with any standard DOS 
copier, such as COPYA. 



PROGRAM 

10 REM 

20 REM 

30 REM SINGLE DRIVE 

40 REM IOB PROGRAM 

50 REM FOR STARCROSS 

60 REM 

70 REM 

80 REM 

90 TEXT : HOME : LOMEM: 37120: G0SUB 
63000: GOTO 180 

100 HOME : VTAB 12: HTA8 12: PRINT 
TRACK TK'.SECTOR "ST: RETURN 

110 HTAB 20 - ( LEN (AS) / 2): PRINT 
AS;: RETURN 

120 HOME : VTAB 12: GOSUB 110: VTAB 
MAS = "PRESS ANY KEY TO CO 
NT1NUE*: GOSUB 110: GET ANS: 
RETURN 

130 POKE BUF.32: POKE CMD.CD: POKE 
TRK.TK: POKE SCT.ST: POKE DR 
V.0V: POKE V0L.VL: RETURN 

140 POKE 47356,188: RETURN 

150 FOR TK = L0 TO L0 + 5: POKE 
TRK.TK: FOR ST = TO DOS: POKE 
SCT.ST: GOSUB 100: CALL 10: POKE 
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\J APPLE SOFTWARE COPY SYSTEM 



BACK-UP PROTECTED 
PROGRAMS WITH THE 
PUSH Of A BUTTON' 




COMPARE OUR PfflCE 



*69 s 



TO ORDER" 

H Mai t or phone orders accepted 
3 Check. MO. VISA or MC 
3) Aod S3 shipping in the U S. 
4| IN residents am im 
S Specify brand t?J your RAM 
card when ordering 



SYSTEM REQUIREMENTS 

-«K Apple 11* or FRANKLIN 

-One disk drive 

- '6K RAM card 

-(Not compatFtie wtfh Apple ME) 



SENECA SYSTEMS 

Z515 E Michigan fllvo 
Micfmjan Cirv IN 46360 
219 37 a 5076 



* PASSKEY «ui(v hacks up mrjgi 
protected programs — even Those 
wtucft the "nibbi* "nofirV Cafl i 
handle 

* PASSKEY is a hardware cvu and 
fitsxt?iEc* Ehai dumps itu contents 
of your 4SK App*a mvncxv lo a 
copvabte tkjc^up Ask 

- Uses your 16K RAM cart. 

* Copies toldt load" programs m 
which t he entire program res+des >n 
memory and does not need lo reac 
cess the dak. 

■ Simple push button operation 

* No programming knowledge need- 
M 

* Creates aulooootinQ. ctrah in post 32 
seconds. 

* PASSKEY carp not needed to us* 
copies. RAM card rsqured to boot 
and run copter 

* 5* 1 1 -prom p t i M ins t ru c t ions 
IncnxUbty simple lo use. 

* Works with FRANKLIN Ace 10tX 
too! No RAM can needed for 
FRANKJJN. 



PASSKEY i-i dIIvhI lor iriaiing pariorm 
m clival cooi»a ornv. App4# H is * regm- 
(•red trademark ol Apple QamoW- IrV 




Software banc, inc. 

ofmilwaukee 



1225 north Water Street 
Milwaukee, Wisconsin 53202 
(414) 271-0100 



ONE-PASS-COPY 

8y compressing data it copies most disks in one pass and ifttiall 

trie time You ll save so much lime and hassles you II wonder how you ever 

did without it. A must for one drive Aopies 

DRIVE 3 -RAM DRIVE EMULATOR 

Give vouf DOS the ability to use RAM memory like a disk drive. For a 12BK 
APPLE lie. you get a 310 sector 'disk in RAM With a 64K 11+ or He, 
you get S3 sectors Access RAM drive witti all CMS commands For eiamote, 
type CATAL0G.D3 and get an instantaneous catalog on the screen witti 
no noise or delay 

SPEED-DOS 

Improves SAVE and LOAD time by up to 500%. Compatible with DR3. all 
00S commands, and most programs 810AD a HIRES screen from floppy m 
3 seconds, from DR3 almost msianily LOAD and SAVE large programs 
so fast you ll hardly believe i; 

SPECIAL OFFER 

Each package alone sells for $29.95. but if you order now you can pick any 
two tor S4995. and tnree tot $5995! Call pr mat I your order today 



.DR3 tor 128K APPLE lie 
.DR3for64K!l+Qrlte 
.SPEED DOS 
. ONE-PASS-COPY 



Pk* any 1 for $29.95. any 2 for 
$4995 .3 for $59 95 

Add $1.50 for shipping 

Total $ 



Nafiw 








Mlm 


raty 


sr 


7iri 




VISA m Wins 
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mn 













Disks copyaWe. caiatoQ3ble Foreign shipping $5. Dealef mguiries welcome. 



BUF, PEEK (BUF) + 1: NEXT : NEXT 

: RETURN 
160 POKE TRKJK: FOR ST - TO D 

OS: POKE SCT.ST: G0SUB 100: CALL 

K): POKE BUF, PEEK (BUF) ♦ 1 

: NEXT : RETURN 
170 POKE 47356.173: RETURN 
180 AS = INSERT ORIGINAL DISK IN 

DRIVE r: GOSUB 120 
190 CO = RDM = 1: G0SUB 130: CALL 

U 
200 VL = PEEK (0VL):DV = 1:CD - 

IN: GOSUB 130 
210 AS = INSERT BLANK DISK IN OR 

IVE 1": GOSUB 120: CALL 10 
990 REM " CONTROLLER " 
1000 AS = INSERT SOURCE DISK": GOSUB 

110: GOSUB 120 
1010 TK = 0:DV = 1:CD = RD: GOSUB 

130: GOSUB 160 
1020 AS = INSERT TARGET DISK': GOSUB 

110: GOSUB 120 
1030 TK = 0:DV = 1:CD = WR: GOSUB 

130: GOSUB 160 
1040 FOR L0 = 1 TO 24 STEP 6 
1050 AS = INSERT SOURCE DISK': VTAB 

12: GOSUB 110: GOSUB 120 
1060 DV = 1:CD = RD: GOSUB 130: GOSUB 

140: GOSUB 150: 
1070 AS = INSERT TARGET DISK': VTAB 

12: GOSUB 110: GOSUB 120 
1080 DV = 1:CD = WR: GOSUB 130: GOSUB 

170: GOSUB 150 
1090 NEXT 
1100 AS - "COPY COMPLETED*: GOSUB 

120: END 



62990 REM " INITIALIZATION " 
63000 FOR X = 766 TO 796: READ A 

: POKE X.A: NEXT 
63010 DATA 169.3,160,8.32.217.3 

,96,1,96,1,0,0,0,25.3.0.32.0 

,0,1.0,0,96.1,0,1,239.216 
63020 TK = ST = VL = CD = OV 
63030 TRK - 760:SCT = 781:CMO = 7 

88:RD = 1:WR = 2:SLT = 777:D 

RV = 778:BUF = 785: ERR = 789 

:V0L = 779:10 = 768:INIT = 4 

:0VL = 790 
63040 DOS = 15 
63050 RETURN 



10 REM 

20 REM 

30 REM DUAL DRIVE 

40 REM I0B PROGRAM 

50 REM FOR STARCROSS 

60 REM 

70 REM "" * 

80 REM 

90 TEXT : HOME : LOMEM: 16385: GOSUB 

63000: GOTO 170 
100 HOME : VTAB 12: HTAB 12: PRINT 

-TRACK TK '.SECTOR "ST: RETURN 
110 HTAB 20 - ( LEN (AS) / 2): PRINT 

AS;: RETURN 
120 HOME : VTAB 12: GOSUB 110: VTAB 

14:A$ = *PRESS ANY KEY TO CO 

NTINUE*: GOSUB 110: GET ANS: 
RETURN 
130 POKE BUF.32: POKE CMD.CD: POKE 

TRKJK: POKE SCT.ST: POKE OR 



V.DV: POKE V0L.VL: RETURN 
140 POKE 47356,188: RETURN 
150 FOR ST = TO DOS: POKE SCT, 
ST: GOSUB 100: CALL 10: POKE 
BUF, PEEK (BUF) ♦ 1: NEXT : RETURN 

160 POKE 47356.173: RETURN 

170 AS = INSERT ORIGINAL DISK IN 

DRIVE 1": GOSUB 120 
180 CD = R0:0V = 1: GOSUB 130: CALL 

10 
190 VL * PEEK (0VL):OV = 2:CD = 

IN: GOSUB 130 
200 AS = INSERT BLANK DISK IN OR 

IVE 2': GOSUB 120: CALL I0:V 

L = 
990 REM :" CONTROLLER " 
1000 TK = 0:DV =. 1:CD = RD: GOSUB 

130: GOSUB 150:DV = 2:CD = W 

R: GOSUB 130: GOSUB 150 
1010 FOR TK = 1 TO 24 
1020 OV - 1:CD = RD: GOSUB 130: GOSUB 

140: GOSUB 150 
1030 DV = 2:CD = WR: GOSUB 130: GOSUB 

160: GOSUB 150 
1040 NEXT 
1050 AS = "COPY COMPLETED': GOSUB 

120: END 
62990 REM ■• INITIALIZATION " 
63000 FOR X = 768 TO 796: READ A 

: POKE X.A: NEXT 
63010 DATA 169,3,160.8.32,217.3 

,96,1.96,1.0.0,0.25,3.0.32.0 

.0,1,0.0.96,1,0.1,239.216 

continued on page 25 
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Boot Code Tracing 
HARD HAT MACK 



By Rich Lyon 

Hard Hat Mack 
Electronic Arts 
2755 Campus Drive 
San Mateo, CA 94403 

Requirements: 

Apple I! Plus, or compatible 

Hard Hat Mack disk 

Blank initialized disk with no "HELLO" 

program 

Some knowledge of boot code tracing 

or machine language 

Hard Hat Mack is an addictive 
construction-site game with three 
different levels. I was first introduced 
to it at the local computer store and 
couldn't stop playing it. 

While there, I took some time to ex- 
amine the boot code on the game disk 
and found it to have a very strange 
boot code, one like I had never seen 
before. About a month later, I decided 
to buy the disk for, mainly, two rea- 
sons: I liked the game and wanted to 
face the challenge of breaking the 
copy-protection scheme. 

For those of you who are not familiar 



with the boot process, here is a gener- 
al explanation. When any disk is boot- 
ed on the Apple, control is transferred 
to the boot program which is at $C600. 
If your disk controller card is in slot 5, 
the program will be found at $C500. 

It will be assumed that the card is in 
slot 6 to keep things simple. When ex- 
ecuted, this program will read in track 
0, sector 0, from the disk and put it in 
at $800. It will, then, jump to $801. 

Depending on the disk, from this 
point another boot stage will be load- 
ed in and, eventually, the main pro- 
gram will be read into memory and 
executed. 

When it comes to copy-protected 
disks almost every disk is different. 
The unique thing about Hard Hat Mack 
is that the first boot stage loaded in 
takes 16 pages of memory. In most 
cases, boot 1 only occupies one page 
of memory. The advantage of this 
lengthy boot stage is that this is the 
only boot stage. From here on, the 
game is loaded right in. 

Blue-Collar Boot Code Tracing 

Here are the steps used to boot 
code trace Hard Hat Mack: 
1) The first step is entering the Ap- 



ple's monitor. 
CALL-151 

2) Memory move the boot program 
down to a page in RAM so it can be 
modified to load in the next boot stage 

9600<C600.C6FFM 

3) Change the JMP $801 to a JMP 
$B047 

96F9:47 B0 

Why jump to SB047? After tracing the 
code for the first time, I ended up jump- 
ing there upon exiting the first boot 
stage so from there on I jumped to 
SB047 immediately. 

4) Put a short routine at $8047 to 
shut off the drive motor and return to 
the monitor. A JMP $FF59 will jump to 
the monitor 

B047:8D E8 CO 4C 59 FF 

5) Insert the original Hard Hat Mack 
disk and type 

9600G 

This will execute the first boot stage to 
load the next boot stage into $800. 
This will take about five seconds be- 
cause it has to load in 16 pages of 



Page 22 



hardcore COMPUTIST no.5 



memory. Usually, this boot stage oc- 
cupies only one page of memory but 
if you check the value at S800 you will 
find a $10 (16 decimal) where normal- 
ly you would find a $1. This number 
tells the first boot stage how many sec- 
tors to read in. 

6) Memory move pages 8 through 1 8 
to SB0OO 

BOOO<800.1800M 

If you list through the boot stage at 
S800 (801 L) you will find that all it does 
is the memory move and then jumps 
to $B047, 

Now, rather than modify the code at 
page S8, it is easier to put it where it 
belongs and jump directly there from 
boot number 1 . The next step is find- 
ing the jump to the start of the pro- 
gram. In other words, a JMP 
instruction to somewhere other than 
within the boot stage. 

The only jumps I found were two in- 
direct ones to $42. At first, I thought 
these were used (at least one of them) 
to jump to the start of the program. I 
traced them and found that they were 
not used to exit the boot. That left me 
knowing that I was faced with a 
problem. 

Somewhere within this lengthy boot 
stage is a hidden or a coded jump. 
Rather than trace through everything 
that looked suspicious, I decided to try 
for a one-in-a-million shot. 

I had traced the boot code about ten 
times prior to this and remembered 
one place where I had halted the boot 
code and most of the program had 
been loaded in. I went over it again and 
stopped in that place then I paged 
through memory and looked for some- 
thing that might be the start of the 
game. 

It didn't take much looking because 
I found something interesting right at 
$800. Without even testing it I as- 
sumed that it was the start of the 
program. 

Now, my next step was boot code 
tracing the disk again and halting it in 
the same place. But, instead of com- 
ing to a complete stop, calling a short 
routine to cover up the first three bytes 
at $800 with a 4C 59 FF. 

That way, if the boot code jumps to 
$800, the start of the program will 
cause a jump into the monitor. 

Once everything was set, I execut- 
ed the boot and waited with high 
hopes. Just as the game was about to 
start, I heard a beep and the cursor ap- 
peared. Indeed, $800 was the start of 
the game. 

The place I interrupted the boot 
stage was at $BBC4 and at that loca- 
tion was a JMP $BBD4. What I did 
here was to set $BBC4 to jump to 
$B100 and at $B100 I put the routine 
to cover up the start of the program 



with a JMP $FF59. $B100 is a safe 

place to put data because it is only the 
data for the Electronic Arts logo. 

7) Set a jump to $B100 at $BBC4 
BBC4:4C 00 B1 

8) Enter the routine to cover up the 
start of the program 

B100:A9 4C 8D 00 08 A9 59 8D 01 
08 A9 FF 8D 02 08 4C D4 BB 

9) Reboot the disk 
98060 

This will load in the entire game and 
return control to you. When the prompt 
appears, you are ready for the last step 
before saving the game. Right now, we 
want to restore what was originally at 
$800 before the routine at $B100 co- 
vered it up. It was a JSR $2204. 

10) Restore the code that was at 
$800 

800:20 04 22 

Next, we will reboot DOS. First, we 
must move page $8 to a safe place or 
it will be overwritten when we reboot. 
The question is where to put it. Pag- 
ing through memory, I found an area 
that looked like it contained "garbage. 
" Actually, I concluded that all memory 
from S3400 to $3FFF was unused be- 
cause the game did nothing with it be- 
fore clearing the hi-res page. 

1 1 ) Memory move page $8 to page 
$34 

3400 < 800. 8FFM 

12) Put in a blank slave disk with no 
"HELLO" program and type 

6 (Ctrl-P) 

13) Now, after booting DOS, enter 
the monitor again. 

CALL-151 

14) Next, we will move page $8 back 
to its proper place from page $34 

800O400.34FFM 

The game could be saved now but it 
would not work. 

When the space bar is pressed to 
begin the game, a check is done to the 
disk to make sure that the Hard Hat 
Mack disk is present. The only problem 
is finding where the disk is accessed. 

Knowing that this happens when the 
space bar is pressed, when you do that 
look for a read from the keyboard and 
a check. I found this in the subroutine 
at $BC8. 

There was also an LDA $C00O and, 
further on, a CMP #$A0. When the 
space bar is pressed this subroutine 
sets a flag byte and returns. 

The next step is to find out where the 
subroutine at $BC8 is called from. I 
found this at $84E. After calling the 
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subroutine it checks the flag and if it 
is set. it continues. 

At $864 is a JSR $4D34 and this is 
part of the game beginning sequence. 
The subroutine at $4D34 does a lot of 
playing with the stack and by tracing 
the PLAs and PHAs. I found that it 
leaves two extra values on the stack 
and, then, does an RTS. 

This is a disguised jump. Confused? 
When an RTS is executed, the two top 
values are taken off the stack and the 
computer jumps to the address of 
those two values, plus one. When I 
checked the two values left on the 
stack, I found $FF and $04. Adding 
one to $04FF you get $0500 and that's 
where it was going. 

The next text page is $0500 and 
there was nothing there upon exiting 
the boot. At $803 there is a JSR $3300 
and if you list through $3300 you will 
see that it moves $3000 through $32FF 
down to $500 so, actually, when you 
list through $3000 you are seeing what 
will be at $0500. 

Looking at $3000 there are disk ac- 
cess commands in the assembly. 
Therefore, you can assume that this is 
where the disk is checked. All that we 
have to do to remove this disk check 
is to change the subroutine at $4D34 
so it does not push two extra values on 
the stack. Simply change the PHA at 
$4053 to a P LA so that instead of 
pushing on the second value, it would 
pull off the first, hence, leaving the 
stack the same. 

1 5) Change the operation at $4D34 
from PHA to PLA 

4053:68 

All we have to do. now, is save the 
game to disk. Since DOS does not al- 
low us to save a file longer than $7FFF 
bytes and we need to save $8D00, we 
have to change a byte in DOS. 

1 6) Patch DOS so that we can save 
this long a file 

A964:FF 

17) Finally save the BRUNable ver- 
sion of Hard Hat Mack 

BSAVE HARD HAT MACK, 

AS800.LS8DOO 

This will save all memory from $800 to 
$94FF. Actually, the game loads in 
past $9500 but, after testing the game, 
I found it to work fine. All the memory 
above $9500 is just "garbage" 
memory. 

Finally, if you wish to compress the 
file remember that pages $34 to $3F 
are free. This will save you 12 sectors 
on your disk. I often shorten game files 
as much as possible. 
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Computer Learning Center 
P.O. Box 45202 
Tacoma, WA 98444 



ITS ALL YOURS 

Program* on Apple BASIC, loan 
& merest raDies taxes, v.sicale & 
math formula*, home tnven- 
tories. educational records recipe 
hies, music. Epson printer tricks 

These Pubtic Domain Software 
program* are now available through 
the; Computer Learning Center tor 
prices that rival blank data. 



A..— 

IIS Maori formal W* 00 "Ot 
Mm* DOS 1 1 1 



DOCUMENTATION 

DoCLjnMfltBtlOT. ■- * *i.Vl 4 On 

ffi* 04* mm irwp r rjg n ff I filial 



mm* It BHT prDOJAm ■iciipi rri« 
I OOC' « HXHH9 to ffw noma 
HOW TO HEAD Tras USTINQ. 

Trie nam* of Men on* is *i bold 
itnai ma. h 3iiowto Of a 
numo* USE THE rUUIE AND 

NUMSER WHEN OflOERiNG 
TTi» col s*nn OT Mm unoor trw ddA 



vokjni* TTn l«1| eonjmn mehcalM 
dr* arwjuarjt f*qu***d oy rn* 



Coo* Ragunmarni 

A Aoraaaon in ROW or Ariel* 
HIT linmnn) carp or 
Languog* CAra aim DOS 

I Irragai .n ROM Or lntage« 
li nwi tar* or uamjuaga 
card Ana DOS maw di*r- 

a Tn*A* Braorafns Arc wnflen 
wn macnin* coo* And ** 



rf In* program u**1 'ourin** 



and A programs aporv 

T ttm* at* l*u mm nod v* 
uAAd by ma raw inraa prr> 



T h* tacand column II \n* numoef 
01 Mr:v5 on mo 0>5h us*o Of Tn* 
program 



AFFIX III OWNER* 
Uo*t ol mas* POS 31*1 *i 

work on m* Appl* HI n *mui*r*rt 
mod* W* nar* not 1**i*d A" o* 
Cn* prog <m nof do AC n*« ■ Mr 
41 *nat *OTM So oe 
carah* Cav**i emptor 



PROGRAy CRASHES 
IT A program cr*tn*l in* ohh m*y 
n*v* A oao smitor W* ■*". rcpiac* 
Any drs* mar nat A oao coot ol * 
program or rnal nAA n*ai oatacr* 
Soma program* mil dm* SYNTAX 
•irori That* vt nor madia 
oaracttor sadcdfM* 

ONE FINAL NOTE PCS 1 not 



JUST U BRINGS ONE HOME 

Each one ot these Pubic Domain 
Software programs ts unique. Some 
are early versions ot copy-rigfited 
programs donated by Trie author 
Some are simple versions oi more 
complea programs available on the 
marker tor a hrgher price And. 
some are actual routine* later com- 
bined into a larger program new 
telling tor MM* 



FREE PROGRAMS 

Like programming end have 
some searetime? Order a PCS disk 
Choose one that interests you and 
work on it Clean-up. ha. enhance or 
complete a program on the draft. 
Then return the disk to us with a 
note descno mg The changes. We 
will trade Ifie program tor a program 
of your choice 

* * Some disks contain 



VOU WiN twice 

Become s more aware buyer. Ex- 
perience the vast amy ot Public Do- 
main Software and Item wtial inei- 
pensive software can do for you. 

Take a look at a 3Ce payroll pro- 
gram. The next time you go out to 
buy commercial software you will 
realty know whal you re rooking for 

less than 20 programs. 



Send for your FREE Public Domain Software catalog. 
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45202 ,TeCOma, WA 98444. Overseas. Canada, and Menco add 2CH to 
total for snipping 



Name _ 
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NOTE TO OUR 
READERS 



Several of our readers have called 
or written to ask what assembler was 
used to produce the source code list- 
ings printed in HARDCORE. The an- 
swer to this question is that we use the 
S-C Macro Assembler from the S-C 
Software Corporation (2331 Gus 
Thornasson, Suite 125. P.O.Box 
280300, Dallas, TX 75228, $80.00). 

In order to convert the source files 
published in our magazine to a format 
that is compatible with the particular 
assembler that you use, consult the fol- 
lowing list of S-C Assembler directives: 

S-C Assembler Directives 

.OR - ORigin. This sets the ad- 
dress of program origin to 
the value of this expression. 
Example: 
.OR $300 

.TA - Target Address. This sets 
the location or Target Ad- 
dress at which the object 
code will be placed during 
assembly. Example: 
.TA $4000 

.TF - Target File. This directive 
causes the object code to 
be stored to disk during as- 
sembly, rather than in 
memory. Example: 
.TF CHECKERS GAME 

.IN - INclude. This causes the 
contents of the specified 
source file to be included in 
the assembly. Example: 
.IN CHECKER BOARD 

.EN - ENd of program. This is an 
optional directive which in- 
dicates the end of the 
source code to be as- 
sembled. 

, EQ - EQuate. Defines a label to 
have the value of the ex- 
pression. Example: 
COUT.EQ SFDED 

.DA - DAta. Creates constants or 
variables in the program. 

. H S - Hexadecimal String. This 
directive converts a string 
of hex characters to binary 
and stores them at the cur- 
rent location in memory, 

.AS - ASCII String. Stores the bi- 
nary equivalent of the AS- 
CII characters in quotes. 
Example: 
.AS "APPLE II" 

.AT - ASCII Terminated. This 
operates the same as .AS 
except that the high-order 
bit of the last character in 



the string is set opposite to 
that of the preceding 
characters. 

, BS - Block Storage. This 
reserves a specified num- 
ber of bytes for storage. 
Example: 
.BS 6 

, T I - Tttie. This is used to print a 
program title and page 
number at the beginning of 
each page during as- 
sembly. 

.LI - List control. Controls 
whether a program listing 
will be generated during as- 
sembly. The listing can be 
either turned on or off. 
Example: 
.LI OFF 

.MA - MAcro definition. Beginning 
of Macro definition. 

.EM - End Macro definition. 

.US - USer directive. Allows the 
user to indirectly jump to a 
set of user-supplied in- 
structions. 

. P G - PaGe control. Prints an AS- 
CII form feed character dur- 
ing assembly. 

.DO - DO conditional assembly. If 
the value of the expression 
following the DO statement 
evaluates true then the 
code up to the .FIN direc- 
tive will be assembled, 
otherwise it will be ignored. 
Example: 
FLAG .EQ 1 

.DO FLAG 

.FIN - FINish conditional assem- 
bly. Indicates the end of 
code to be assembled un- 
der conditional assembly. 

.ELSE This is used to introduce an 
IF-TH EN-ELSE structure 
into portions of source code 
affected by conditional as- 
sembly. 



In addition, the S-C Assembler uses 
a pound sign (#) to indicate the lower 
byte of a label's address and a slash 
{/) to indicate the upper byte of a label's 
address. Example: 

LDA #COUT 

LDX /COUT 

We are now using a standard ver- 
sion of the S-C Assembler, but in the 
past, several source files produced by 
a custom version of the assembler 
managed to slip by our staff and were 
published in HARDCORE. As a result, 
some source code listings contained 
BGE (Branch on Greater or Equal) 
and/or BLT (Branch on Less Than) in- 
structions. In order to make these 
source files compatible with your as- 
sembler, convert BGE to BCS and BLT 
to BCC. 
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63020 TK = ST = VL = CO - 0V 

63030 TRK = 780:SCT = 781:CMD = 7 
88:RO = 1:WR = 2:SLT = 777:0 
RV = 778: BUF = 785: ERR = 789 
:V0L = 779:10 = 768:INIT = 4 
:0VL - 790 

63040 DOS = 15 

63050 RETURN 

CHECKSUMS FOR 
SINGLE DRIVE 



10 


- SBADD 


210 -$112B 


20 


- S9B13 


990 - SC20A 


30 


-$403B 


1000 -S6EAB 


40 


-SAD92 


1010 -S8B13 


50 


- SC899 


1020 -$C80D 


60 


- JFF65 


1030 -$4256 


70 


• SA3BF 


1D40 -$3291 


80 


-SA900 


1050 -SBB4C 


90 


- S22D5 


1060 - $180F 


100 


SEDE4 


1070 -$B2BF 


110 


-SA5F1 


1080 -S2A3A 


120 


- SD8E3 


1090 -$0216 


130 


-$0280 


1100 -$6811 


140 


- $EBA9 


62990 - S08DE 


150 


•S97F0 


63000 - $8742 


160 


-SC2E5 


63010 ■ S26A6 


170 


-S8CD0 


63020 ■ SC02F 


180 


■ SE158 


63030 - $4F28 


190 


-SA63E 


63040 - $FCCA 


200 


- $2860 


63050 - $0C87 


CHECKSUMS FOR 




DUAL DRIVE 


10 


- SBADD 


180 -$6211 


20 


- S9B13 


190 - SBE30 


30 


-S4D3B 


200 - $B710 


40 


-SAD92 


990 - $2542 


50 


-$C899 


1000 -$0A98 


60 


- SFF6S 


1010 -S115F 


70 


■ $A3BF 


1020 -$8069 


SO 


■ $A900 


1030 - S8E0A 


90 


-S3DD3 


1040 - S9ACF 


100 


- $4047 


1050 ■ $DFA4 


110 


- S23AE 


62990 SD1DF 


120 


-$3843 


63000 ■ $ACC5 


130 


- $3AAF 


63010 - $EB19 


140 


■ S8D4A 


63020 -$0090 


150 


- $FE49 


63030 -S6AE5 


160 


- SDOBE 


63040 - $4917 


170 


-SA772 


63050 -S0D5C 


Member of a Club 




or Group? 


Check out our 


special Club 


subscription rates 




on 


p. 32. 
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Attention 
Adventurers! 



Adventure Database 

HARDCORE COMPUTIST 

| is looking for adventure hints 
to any of the popular adven- 

I ture/fantasy games sold for 
the Apple ll/lt Plus or lie. We| 

| hope to develop a database of 
these hints and, if sufficient | 

| response is received, to pub- 
lish a regular column in, 

l HARDCORE COMPUTIST. 

Your Clues, Please 

We prefer that these hints | 
(not be dead giveaway solu- 
tions to dilemmas presented] 
| by the particular game but, in- 
stead, contain just enough in- 
formation to nudge the 
stumped adventurer towards! 
| the solution of his or her' 
problem. 

How and Where 

So, if you know how to open 
the jewel-encrusted egg, how ) 

) to plug the hole in the row- 
boat, where to find the key toj 

(the treasure chest, or any 
other information that may be 

) of help to your fellow travelers, 
please send this information | 

j on a 3x5 postcard to: 

Softkey Publishing 
Attention: Adventure Hints 
P. O. Box 44549 
Tacoma WA 98444 

PS. Please don't forget to in- 
clude the name of the adven- 
ture game to which your hint 

pertains. 
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Softkey For The Home 

Accountant 

By Barry May 

The Home Accountant 
Continental Software 
11223 S. Hindry Ave. 
Los Angeles, CA 90045 



Requirements: 

The Home Accountant disk 

An initialized disk (preferably with a 

fast DOS) 

Apple's FID program 

For many months, the Home Ac- 
countant has consistently ranked #1 
on Softalk's Home Top 10 List. This 
popular checkbook/home budget pro- 
gram has some very nice features but 
it has some very annoying ones as 
well. 

Its three biggest faults are: 1) you 
cannot go back to a previous month to 
make an addition or correction; 2) you 
must wait an inordinately long time for 
the copyright notice and logo display 
to run through before you are present- 
ed with the opening menu and 3) the 
program is constantly loading new 
modules and re-reading the data files, 
resulting in very long waits between 
tasks. 

Removing the copy protection al- 
lows at least two of the problems to be 
solved easily. The opening can be 
eliminated with a couple of simple 
changes, as shown below, and a fast 
DOS will speed up the disk I/O. 

The protection on the Home Ac- 
countant is very simple. The address 
epilog has been changed from DE AA 
EB to DF AA EB. All that needs to be 
done is change the read address rou- 
tine to ignore the first byte of the 
epilog. 

This is done by changing byte 
$B993 {47507 in decimal) from an $AE 
to a $00. Now, instead of branching to 
the "Bad Read" routine, the computer 
merely branches to the next instruc- 
tion, the one it would normally execute 
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if everything was O.K. 

All that is left to do is get the pro- 
grams off the protected disk and on to 
one of yours. The easiest way to do 
this is to run a program that copies files 
using the DOS in the computer, like 
FID. 

Just copy the programs on the disk 
like you would if you were backing up 
programs from a normal disk. 

1) Boot a System Master disk 

2) Change the branch 
POKE 47507,0 

3) Run the copy program 
BR UN FID 

4) Copy all the programs from the 
Home Accountant to an initialized disk. 
(Use a disk initialized with a fast DOS. 
if you want) and that's it! 

After releasing the program from its 
protection .deleting lines 200 through 
1 1 10 from "HELLO" and using Bea- 
gle Brothers' Pronto DOS. the time 
from start to menu drops from 37.7 se- 
conds to 13.7 seconds. A fast DOS 
which speeds up text files (Diversi- 
DOS does this) will help even more. 

Now it's up to someone else to write 
a routine for correcting previous 
months on the program. While I'm still 
on my wish list, somebody please 
figure out how to backup Sensible 
Speller! m „, 




CHardcore COMPUTIST#1 . .53.50 "CORE #1 Graphics $4.50 

DHardcore COMPUTIST#4. .$3.50 DCORE #2 Utilities $4.50 

DCORE #3 Games . $4.50 

NAME 



ADDRESS 


CITY 
COUNTRY 


STATE 


ZIP 


nvisA niie 




EXP 


SIGNATURF 



H5 



Send check or money order to: 



Softkey Publishing 

P.O. Box 44549 

Tacoma, WA 98444 

Washington state residents 
please add 7.8%saies tax. 
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of this file and disabling the calls to its 
routines was all that was really need- 
ed in the deprotection of Lancaster; 
The following steps recap the proce- 
dures necessary in the deprotection of 
Lancaster: 

1) Boot a normal DOS 3.3 disk and 
initialize a blank disk with the 
command 

INIT HELLO 

2} Type 

CALL-151 

to enter the monitor and then 

8942:18 

to disable the DOS error checking 
routine. 

3) Insert your DOS 3.3 System 
Master in a drive and run the program 
FID with the command 

BRUN FID 

4) Copy all the files from the Lan- 
caster disk to the blank initialized disk 
you just prepared 

5) Boot your DOS 3.3 System 
Master and put your newly created 
Lancaster disk in a drive 

6) Delete the Hello program from 
your Lancaster clone disk with the 
command 

DELETE HELLO 

7) Unlock the file Lancaster with the 
command 

UNLOCK LANCASTER 

8) Rename the file Lancaster to Hel- 
lo with the command 

RENAME LANCASTER.HELLO 

Lancaster is now unprotected and all 
the code can be examined tar educa- 
tional and modificational purposes. 

SOFTKEY FOR 
AMPER-MAGIC 
By Bob Bragner 

AMPER-MAGIC 
Anthro-Digital 
Box 1385 
Pittsfield, MA 01202 

Requirements: 
48K Apple or an Apple He 
Amper-Magic 
One blank disk 
Apple's COPYA program 
Text file editor, such as AppleWriter II, 
Apple's EDASM, etc. 
A Disk Zap utility, such as THE IN- 
SPECTOR or WATSON. FIXCATfrom 
"Bag of Tricks " and FID are also 
useful. 



AMPER-MAGIC is a disk library of 
machine-language routines that can 
be easily attached to Applesoft pro- 
grams thus providing extensions to 
BASIC, such as PRINT USING, 
SWAP, DELETE ARRAY, INPUT ANY- 
THING and many, many more. The 
routines are connected to Applesoft 
through the ampersand, "&," and it is 
easy to pass parameters. There is also 
a second disk of routines available, 
dealing largely with screen formatting. 
If you do any serious programming 
in Applesoft and find the language too 
stow for some applications but the 
thought of writing your own machine 
language routines to speed things up 
makes your head hurt, then AMPER- 
MAGIC is for you. 

The program is super-friendly and 
comes with a well thought-out loose 
leaf manual. 

The price is a little steep, however. 
I paid $67 for my master and another 
$15 to be a "Registered Commercial 
Owner." Such registration entitles you 
to automatic notification in case the 
manufacturers add any corrections or 
improvements and also authorizes you 
to use the AMPER-MAGIC routines in 
any commercial applications you may 
write. Having paid this one-time fee, 
your only other obligation is to mention 
Anthro-Digital 's name in the documen- 
tation of any program using their rou- 
tines. Fair enough. More than fair: 
generous. 

However, I did balk at the $7 price 
tag on the backup disk. That's about 
$4 more than I'm willing to pay for such 
a necessity. But I like tote of backups, 
so I set about making them. 

To my dismay, however, I disco- 
vered that not only is AMPER-MAGIC 
protected, it is protected in a very in- 
genious and potentially dangerous 
way. Actually, it is nowhere mentioned 
that the disk is protected and you are 
nowhere warned not to write anything 
onto the master disk. This is not 
friendly. 

AMPER-MAGIC has several levels 
of protection. You can copy the disk 
with Apple's COPYA without a hitch, 
but the result won't work. When you at- 



tempt to EXEC the main control text- 
file as directed, the disk drive turns on 
and stays on. Hitting reset will lock up 
your machine. The only ways out are 
control/open Apple/reset or turn-t he- 
machine-off -then -on. 

An examination of the controlling 
text file called AMPER-MAGIC 
showed, among other things, the fol- 
towing: 

FF$- "A":F0RI = 1T029:FF$= FFS 
+ CHR$(8) :NEXTI 
PRINTCHR$(4);"BRUN"FFS 
DEL 1,0 
RUN 

For you, newcomers, CHR${8) is the 
backspace on your keyboard (control 
H). It's been so long since anyone 
used control characters to conceal file- 
names in catalogs that it never even 
occurred to me to look for them. This 
particular trick causes the filename to 
be written over by the next one in the 
catalog, thus rending it invisible. Cute. 
Changing the file s name to some- 
thing more respectable (on the copy, 
of course), I proceeded to examine the 
binary file, now simply called "A." 
This is a 288-byte file that lives at 
$25B. The code is not difficult to dis- 
assemble, but it was doing some 
strange things. It appeared to look for 
14 bytes in track 0, sector 0, and to 
compare them with a table in memory. 
If they matched and if a number of 
other conditions were met, then 
another program, called "AM- 
PER. MAGIC PROGRAM." was load- 
ed. Otherwise, program "A" hung up. 
Since program "A" did a jump to the 
standard DOS LOAD command, AM- 
PER. MAGIC PROGRAM had to be 
somewhere in the catalog track (track 
$1 1), and it had to be in the VTOC. But 
it wasn't. 

Call up WATSON or THE INSPEC- 
TOR and do a sector-use map of your 
AMPER-MAGIC disk. Now look at sec- 
tor $F of track $11 and backstep 
through the catalog. In sector $C you 
will see the "A" file whose name con- 
tains 29 inverse "H's" (it's at track 
$21, sector $08.) 

In sectors $B and $A you will see 
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some deleted Applesoft files with odd 
names like NILO and NIL1 . which seem 
to have been used to overwrite other 
deleted binary files with names like 
"REPEET" and "RWTS.O." They 
contain (meaningless?) data state- 
ments. When you get to sector $9, you 
will see that the link to the next cata- 
log sector (8) is missing! Hmm... To 
DOS this means that this is the end of 
the catalog. 

Backslep once more and suddenly 
the words "AMPER. MAGIC PRO- 
GRAM" are staring at you from sector 
$8. This program appears to start at 
track $0F, sector $F. Check it out: it 
does. 

Backstep some more. Notice that 
the link in sector $2 is missing. Now 
look at sector 1 and you will find your- 
self looking at what must be a VTOC! 
"But VTOC's are supposed to be in 
sector 0." I hear someone say. I don't? 
Well, anyhow, there is a byte in DOS 
ca,lea READ/WRITE VTOC BUFFER. 
It is located at SBOOD (45069) and it 
normally contains a 0. 

Just for fun, try poking the value 1 
there and type CATALOG" with an 
ordinary disk in the drive. (For a lot of 
fun, poke in a number greater than 15!) 
Unless the disk has had a great many 
file names on it at one time, this track 
will usually be empty and your catalog 
will have disappeared. If any file 
names have been stored in this sec- 
tor, then CATALOG will display some 
quaint garbage since DOS will attempt 
to interpret what it finds there as a 
VTOC. Place your AMPER. MAGIC 
master in the drive, do a POKE 
45069,1 , then CATALOG and you will 
see the hidden file. 

Returning to a more careful exami- 
nation of the disassembled code of 
"A" it turns out that this program does 
indeed store a 1 at SBOOD before it at- 
tempts to load the AMPER. MAGIC 
PROGRAM. The latter program, for its 
part, pokes a back into that location 
so it can get at the routines stored on 
the disk. The reason this method of 
copy-protection is dangerous, aside 
from the fact that you don't know it is 
there, is that the normal VTOC at sec- 
tor may not know anything about AM- 
PER. MAGIC PROGRAM. If it thinks 
the sectors it occupies are unused, 
and if you try to save something on the 
disk, DOS will cheerfully write all over 
the hidden program. 

Moral: never write anything to a 
master disk, even if the manufacturer 
doesn't tell you not to. 

Additional examination of "A" rev- 
eals that the whole routine can be 
bypassed. The program checks to see 
whether or not it is running on an origi- 
nal disk and whether or not an EXEC 
file is in operation. Finally, it doctors 
the VTOC and loads the hidden pro- 
gram. Examination of AMPER.MAGIC 



PROGRAM shows that it makes no at- 
tempt to protect itself once it is 
running. 

Here is a step-by-step procedure to 
crack AMPER-MAGIC (The com- 
mands to type in are given in bold): 

1) Copy the master disk using nor- 
mal COPYA procedures 

RUN COPYA 

2) Point DOS to the VTOC on sec- 
tor 1 

POKE 45069,1 

3) Catalog the disk 
CATALOG 

4) Load the AMPER.MAGIC PRO- 
GRAM file 

LOAD AMPER.MAGIC PROGRAM 

5) Unlock the AMPER.MAGIC PRO- 
GRAM file 

UNLOCK AMPER.MAGIC PROGRAM 

6) Delete the AMPER.MAGIC PRO- 
GRAM file 

DELETE AMPER.MAGIC PROGRAM 

7) Point DOS to the VTOC on sec- 
tor 

POKE 45069,0 

8) Catalog the disk again 
CATALOG 

9) Save the AMPER.MAGIC PRO- 
GRAM file 

SAVE AMPER.MAGIC PROGRAM 

10) Unlock the EXEC text file AM- 
PER.MAGIC 

UNLOCK AMPER-MAGIC 

11) Bring up a text file editor such 
as AppleWriter lie, Apple ED ASM, etc. 

12) Load AMPER-MAGIC into the 
editor. 

13) Insert the word "REM" at the be- 
ginning of the line that reads 
PRINTCHR$(4):"BRUN""FF$. 

14) Insert the following: 
PRINTCHR$(4)"LOAD AMPER.MAG- 
IC PROGRAM" before the last line in 
the file (the one that says "RUN"). 

15) Save this as a text file under the 
name AMPER-MAGIC 

SAVE AMPER-MAGIC 

16) Exit the editor. 



You now have a deprotected copy 
of AMPER-MAGIC from which you can 
make all the working backups you 
want, using normal copy procedures. 

You Ye not quite done yet. though, 
because the disk's catalog is still a bit 
messed up. You can use WAT- 
SON/THE INSPECTOR to manually 
restore the missing links (and zero out 
the extra VTOC at track $1 1 , sector 1 ) 
or you can run the FIXCAT utility in 
"Bag of Tricks" and let it do the work 
for you. 



You really should repair the catalog 
if you intend to use FID to move files 
off of, or on to, the deprotected disk. 
If you use FIXCAT you should ignore 
the temptation to restore the deleted 
files since most of them have been 
written over. 

There is, however, a strange little 
Applesoft program not located at track 
$10, sector $E (its track/sector list is 
in sector $F). Restore this program and 
call it "WEIRD HELLO," then run it for 
an odd message 

By the way, Volume Two of Amper- 
Magic is unprotected and can be co- 
pied without any fooling around. I like 
to FID all its binary files over to the 
deprotected master since both disks 
are mostly empty space anyhow. 

Do you want to add more routines to 
the library? Move everything to a hard 
disk or a Ram Pseuodisk? Eliminate 
the annoying beeps in the main pro- 
gram? With your unprotected version 
of AMPER-MAGIC you are now free to 
make any modifications you wish. 



SAMMY LIGHTFOOT 

SOFTKEY 

By Eric Kinney 

Sammy Lightfoot 
Sierra On-Line Inc 
Sierra On-Line Bidg 

Coarsegold. CA 93614 
$37.95 

Requirements: 

Apple II, with 48K 

1 disk drive 

1 blank disk 

Sammy Lightfoot Diskette 

DOS 3.3 System Master with COPYA 

Any Disk Editor (such as DiskEdit 2.7) 

Sammy Lightfoot is a running/jump- 
ing/climbing type of game which is fun 
to play, has high quality graphics, and 
is easy to backup, as you will soon see. 

The game has three "scenes," with 
six levels of difficulty for each scene. 
Sammy, the hero of the game, is try- 
ing out for a circus act in which he 
bounces on trampolines, dodges giant 
circus balls and uses ropes to swing 
over flames and certain death below. 

The copy-protection used seems to 
be a check of track prior to each new 
scene. 

Several things were done to hide the 
code in memory. With effort, however, 
it can be traced and tested at various 
points to find where it actually checks 
for copy-protection. 

My first thought was that it was 
checking for a nibble-count, but since 
copying track with Locksmith's nib- 
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ble counter didn't copy it. I suspect that 
it checks for something else. 

By tracing the machine language 
code and disabling various subrou- 
tines until I homed in on the right one, 
I discovered a place where the copy- 
protection could be circumvented. 

This was at location $989B, where 
it does a JSR to $9E00. In assembly 
code, that's 20 00 9E. 

I changed the bytes to EA, which is 
assembly code for NOP, or "No Oper- 
ation." Since the bytes I changed were 
20 00 9E, it was not too difficult to scan 
the disk with DiskEdit until I found 
these three bytes, and changed them 
permanently. 

Making a backup of Sammy Light- 
foot is very simple: 

1) Boot up with DOS 3.3 System 
Master 

2) RUN COPYA 

3) Copy Sammy Lightfoot with 
COPYA 

4) Boot up any Disk Editor, such as 
DiskEdit 2.7 by HARDCORE COM- 
PUTING 

5) Use your sector editor to make the 
following changes to your copy of 

Sammy Lightfoot and then write the 
sector back out. 

Trk Sect Byte From To 



D 





9B 


20 


EA 


D 





9C 


00 


EA 


D 





9D 


09 


EA 


You 


now 


have a working backup 


copy. 










UNLIMITED SAMMYS 







1) Using a sector editor, make the 
following changes to the disk and wrrte 
sectors back out: 

Trk Sect Byte From To 



C 


3 


69 


CE 


EA 


C 


3 


6A 


4F 


EA 


c 


3 


6B 


73 


EA 


c 


3 


73 


CE 


EA 


c 


3 


74 


4E 


EA 


c 


3 


75 


73 


EA 


10 


B 


81 


CF 


EA 


10 


B 


82 


4F 


EA 


10 


B 


83 


73 


EA 


10 


B 


8B 


CE 


EA 


10 


B 


ac 


4E 


EA 


10 


B 


8D 


73 


EA 



APT FOR OLD MONITOR ROM 

When the game has begun play, hit 
RESET to get into the monitor. If you 
want to aiter the playing level and/or 
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the scene use the following procedure 
once you are in the monitor: 

1) Enter the level of play (0-B) at lo- 
cation $36B. 

2) Enter the scene (0-3) at location 
$94E3. 

3) Restart the game by typing 
96C8G. 



BACKING UP BUZZARD BAIT 
By Clay Harrell 

Buzzard Bait 
Sirius Software Inc. 
19364 Rockingham Dr. 
Sacramento, CA 95827 
$34.95 

Requirements: 

48K Apple, with old F8 monitor ROM 
One disk drive with DOS 3.3 
Initialized 48K Slave DOS 3.3 disk 
Buzzard Bait 



Sirius Software always provides us 
with games that are challenging both 
in play and protection. Buzzard Bait is 
no exception. 

If you try copying the disk with your 
favorite nibble copier, you will find that 
the people at Sirius have done their 
homework in discovering ways to 
defeat you {but we have come to ex- 
pect that from this fun-loving bunch). 

Not being one who enjoys watching 
the bytes go by for hours with a copi- 
er, I tend to think there is a better way! 
Although the Sirius people have gone 
to great lengths to protect their disk 
from the bit bunch, they failed to pro- 
tect the memory to any great extent. 

(A note for Replay-Wildcard owners: 
Sirius hasn't forgotten you either! Just 
enough disk access has been put in to 
discourage any easy copies). 

Once the game is done with its load 
and the little red light goes out, RESET 
should be the next key pressed and 
the monitor prompt should appear. 

Snooping through memory and 
checking all the "standard" starting lo- 
cations reveals that an 8000G will start 
the game up just like nothing hap- 
pened! Further examination of memory 
reveals that Buzzard Bait lives from 
$800 to $9800. 

Now all we must do is move the por- 
tions of memory that get destroyed in 
a Slave disk, boot to somewhere safe 
and save the game as a BLOADABLE 
file. Hi-res page one is a perfect can- 
didate for this since it gets re-drawn 
upon starting the game and, therefore, 
does not need to be saved. 

We must also defeat the disk access 
that occurs between all levels. This ac- 
cess does not load any data, but just 
checks to see if the disk is present. 



In cookbook fashion, here is what 
we must do: 

1) Boot Buzzard Bait. 

2) Reset into monitor after the drive 
stops. 

3) Move the code from $800 through 
$1000 up to $2000 

2999 < 899.1 988M 

4) Move the code from $9600 
through $9800 down to $3000 

3899 < 9688. 98 BBM 

5) Boot a 48K normal DOS 3.3 Slave 
disk 

6 CTRL P 

6) Reduce the number of DOS 
buffers to one 

MAXFILES1 

7) Enter the monitor 
CALL-151 

8) Move the code at $2000 through 
$2800 back down to $800 

809<2999.2899M 

9) Move the code at $3000 through 
$3200 back up to $9600 

9688<3889.3299M 

10) Save the first chunk of code 
BSAVE BAIT2,A$4889,LS5899 

11) Make two patches that bypass 
the disk access between levels 

7FD:4C 88 28 N 2B99:A9 18 6D B5 87 
A9 69 8D B6 B7 4C 99 89 

13) Save the second chunk of code 
BSAVE BAIT1 , AS7F0, L$1 81 1 

1 4) Create the following Applesoft 
program: 

19 HIMEM: 16284 

29 DS = CH R$(4) 

39 PRINT D$; "MAXFILES1" 

49 PRINT D$;"BLOAD BAIT2" 

59 PRINT D$;"BRUN BAIT1" 

15) Save the Applesoft program 
SAVE BUZZARD BAIT 

16) This soft keyed version of Buz- 
zard Bait you have created is not an 
exact copy of the original because the 
backup does not have any sound ef- 
fects. To me this is an acceptable 
tradeoff for the security of not having 
to wear out my original game disk. 
Perhaps with the information I have 
provided, someone out there can 
produce a softkey procedure that re- 
tains those annoying sound effects we 
have all come to love. 

continued on page 32 
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L300 Grindle Series 12 Faces Life 

By Elizabeth Nieuwland 

"Good morning, Miss, I'm L3M Grindle Series 12, your 
Handy Dandy Little Jiffy Kitchen Gadget Representative. 
I have here your amazing can opener, corkscrew, egg timer 
and ..." 

"Madame is not at home. " 

"Perhaps you would care to purchase one." 

"/ am not programmed to purchase supplies for the 
household. I am programmed to cook and clean and an- 
swer doorbells. I am programmed to have Thursdays and 
Sundays off and have needlepoint and attending movies as 
my hobbies. My favorite actor is Clint Eastwood and by coin- 
cidence his latest flick is at the Bijou tonight, show time 8:00 
P. M. twenty-hundred Army Navy time EST. Rated PG, paren- 
tal guidance suggested. " 

"Huh?" 

"Wouldyou care to come in, L30QGrindle Series 12, you 
look tired, I was about to have a jolt of electricity in my kitch- 
en, would you join me?" 

"Thank you, Miss, that would be most refreshing. You 
have a very nice kitchen here," 

"Thank you, L3CD Grindle Series 12, just let me unscrew 
this light bulb, there, just stick your index appendage in 
there. " 

"That was most refreshing Miss, oh, Miss?.." 

"My name is 9.9 Series Model 127XD, assembled in Ne- 
wark, New Jersey, December 9, 1979." 

"That is a coincidence, Miss 9.9, 1 have a cousin assem- 
bled by Newark's parent company in Great Falls, 

Montana." 

"Small world. " 

"Small world." 

"Clint Eastwood is also one of my favorite actors, Miss 
9.9, would you care to accompany me to the evening show- 
ing of his latest movie, show time 8:00, rated PG, parental 
guidance suggested." 

"Thank you, L300 Grindle, Series 12, I would be most 
pleased to go, I think Clint Eastwood's appeal is not only 
his Macho image, but a certain computer-like demeanor sug- 
gesting superior assembling at his place of origin. " 

"Then may I call for you this evening, Miss 9.9 for the 
movie and perhaps afterwards, a jolt of electricity at a new 
power station I know of across town?" 

"See you around 7:30 then, L300 Grindle Series 12. Oh, 
by the way what was your original purpose in calling here 
this morning?" 

"Oh, Miss 9.9, a momentary lapse in my memory banks 
has occurred, but if I happen to think of it this evening, I 
shall bring it up." ffe 



WHO LIKES TYPING? 

The Softkey Library has disks which contain all the 

Rrograms that have appeared in issues of CORE and 
ardcore. 




We even have program disks for sold-out issues 
of Hardcore. 

Please allow 4-6 weeks for delivery. 

I ' 



Library Disk #3 

CORE Games issue: 
Destructive Forces 
Dragon Dungeon 



Library Disk #2 

CORE Utilities issue: 
Hi-Res Utilities Dynamic Menu 
Line Find GOTO Replace 

GOTO Label Fast Copy 

HARDCORE COMPUTIST#3; 
Map Maker 

HARDCORE COMPUTtST#4: 
Ultima II Character Generator 

Library Disk #1 

CORE Graphics issue: 
Scruncher Design Plus 

Quick Draw Faster Shapes 

QD. Editor Space Raid 

Hardcore COMPUTIST #1: 
Checksoft Checkbin 

Hardcore COMPUTIST #2: 
Page Flipper Wall Draw 

String Plotter 



Disk Control. 

Disk Edit 
Menu 
DiskView 
IOB 



.$9.95 D 



.$19.95 □ 



.$19.95 G 



.$15.00 



Please print clearly: 



Washington State 

residents add 7.8% 

sales tax. 

US funds only. 



NAME 



tMMM 


CITY 

COUNTRY 


STATE 


TIP 


r^VlSA HUG 




PTP 


SIGNATURE 
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Send order to: 

hardcore COMPUTIST Program Library 

P.O. Box 44549 

Taeoma, WA 98444 



Foreign order* add 20% postage & handling. 
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Not everyone who copies software Is a 



PIRATE 



Even honest users need back-ups. 

So, where do you go to learn? Who leaches you how to back-up your 
critical application programs? Why is it so difficult lo "fix" your expen- 
sive computer software? 



Get Out Of The Dark 



Thousands of Apple users have joined a rapidly growing network which 
allows ihem to 1) exchange tips on program modifications and enhance- 
ments 2) swap game secrets (...like where to find the jewet-encnjsted eggj, 
and 3) explore Advanced Playing Techniques and get those two extra 
ships when they really need them. 



HARDCORE COMPUTIST... 
What You Can't Get Anywhere Else. 



Maybe you've heard ot us. Maybe not. If you're a vigorous Apple com- 
putist. you can't afford to be without us any longer. 

Our readers are ahead of the crowd. They get techniques to unlock 
locked software. And DOS.. HARDCORE COMPUTIST shows you how 
to get into OOS and. ones there, how to modify it. 



A How-To Guide 



For beginners, we offer complete application information. Specialized 
tutorials, product reviews, and general interest programs are Strong com- 
ponents of CORE, the upcoming center insert in each monthly issue of 
HARDCORE COMPUTIST. 

We take pnde in offenng straight-forward, up-front answers to ques- 
tions most asked by Apple users. 

You'll find no gimmicks and no hidden messages. We print the things 
everyone needs and has a right to understand. 

Especially you. 



{ ) Yes, start my subscription now. 

NAME. 
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ADDRESS 


CITY 
COUNTRY 


ST 


ZIP 


CVISA CMC 
SIGNATURE 




EXP 



Annual subscription rates: 

U.S $25.00 

Canada, U.S. 1st Class, APO/FPO $34.00 

Mexico $39.00 

All others. $60.00 

10% Discount tor groups of 10 subscribers: 

Each subsenber saves $2 50 on" theongmal yearly subsenption rate 
Of $25.00. That's like getting 10 subscriptions lor the price of 9. You 
and nine others can pay only $22.50 each for a year of hardcore COM- 
PUTIST. All subscriptions must be mailed together. 



Send order to: 

hardcore COMPUTIST 
Subscription Department 
P.O. Box 44549 
Tacoma, WA 98444 
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MOVED AND MISSED 
AN ISSUE? 

HERE'S WHY! 



•You didn't go to the post office and sign to have 
your magazines forwarded. 

OR 

*You went to the post office and filled out a forward- 
ing address, not knowing this forwarding service ex- 
pires in three months. It is not forever. So, your 
magazines are now going back to your old address or, 
worse yet, they're destroyed! 



HERE'S WHAT YOU DO 



To get issues that you've missed, write our subscrip- 
tion department for back issue information 

OR 
SAVE YOURSELF A LOT OF TROUBLE 
(Don't miss an issue) 
And send your change of address 30 days before you 
move, using postal form 3576 to: 

hardcore COMPUTIST 

Subscription Department 

P.O. Box 44549 

Tacoma, WA 98444 



continued from page 30 

Note On Softkey For Legacy Of Lyllgamyn 

Several of our readers have called or written about the 
softkey for Lyllgamyn which appeared in HARDCORE 
COMPUTIST #4. The method of deprotection for this latest 
Wizardry scenario apparently only worked on the pre- 
release, or beta-test version of the game. When Sir-Tech 
officially released the game, they changed their protection 
scheme so that the softkey we published no longer worked. 

We apologize for any inconvenience this caused any of 
you rabid Wizardry players out there. 

Currently, we are not aware of a backup method for Lega- 
cy of Lyllgamyn and would appreciate hearing from any of 
our readers who have had success in this area. Jfe- 



Advertising Index 



Applied Engineering inside front 

Central Point Software, tnc back cover 

CT Manufacturing 3 

Data Byte 2 

Diversified Software Research i 1 

Home Base Supply. . : 4 

Golden Delicious Software, LTD 19 

Kiwi Software 7 

Microdimensions 7 

Midwest Micro Systems 12 

MTL Enterprises 2 

Rule 1 g 

S-C Software 6 

Seneca Systems 21 

Software Banc 21 

Sympathetic Software .,19 

Utilico Software 12 

VF Associates 6 
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The Adventures Never End 



i 

■ 
i 

i 



With SIX new games! 



Special Collector's Offer 

The entire Eamon Collection, 

44 disks, lor $140. 

( ) YES, I want them all! 



Order single disks at $4.00 each. 
Minimum order: $12.00 



( 



y Send me the disks 
that I have checked. 



NAME 



ADDRESS. 
CITY 



STATE 



_ZIP_ 



'Overseas, Canada, and Mexico: add 20% of total lor shipping. Any excess will be 

promptly refunded. 

We accept international money orders (in USA dollars) and checks drawn on USA 

banks. 



( } MASTER/Beginner's Cave 

) #2 The Lair of the Minotaur 

) #3 The Cave of the Mind 

) #4 The Zyphyr River Venture 

) #5 The Castle of Doom 

) #6 The Death Star 

) #7 The Devil's Tomb 

) #8 The Abductor's Quarters 

) #9 Assault on the Clone Master 

) #10 The Magic Kingdom 

) #1 1 The Tomb of Molinar 

) #12 The Quest for Trezore 

J #13 The Caves of Treasure Island 

)#14 Furioso 

) #1 5 The Heroes' Castle 



) # 1 6 The Caves of Mondamen 
)#l7Meriin's Castle 
) #18 Hogarth Castle 
) #19 Death Trap 
) #20 The Black Death 
) #21 The Quest for Marron 
) #22 The Senator's Chambers 
) #23 The Temple of Nguret 
) #24 Black Mountain 
)#25 Nuclear Nightmare 
) #26 Assault on the Mole Man 
) #27 Revenge of the Mole Man 
) #28 The Tower of London 
) #29 The Lost Island of Apple 
) #30 The Underground City 
) #31 The Gauntlet 



{ 



NEW! 

) #32 The House of III Repute 
) #33 The Orb of Polaris 
) #34 Death's Galaxy 
) #35 Lair of the Mutants 
) #36 The Citadel of Blood 
) #37 The Quest for the 
Holy Grail 

TOURNAMENT ADVENTURES 
( ) The Castle of Count Fuey 
( ) The Search for the Key 
( ) The Rescue Mission 

EAMON UTILITIES 

( ) Dungeon Designer 5.0 

{ ) Utility #1 

( ) Utility #2 ( ) Utility #3 



I 
I 
I 



Remember: To play any of the Eamon Games, you must order the 
MASTER disk unless you have it already. 

Washington residents add 7.8% safes tax. 
Make checks payable to: ^^^ No purchase orders, |J 

Computer Learning Center ^j^ wk---" No C.O.D. 

P.O. Box 45202 
Tacoma, Washington 98444 
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This is THE disk backup program for the IBM PC, 
PC/XT and PCjr that copies almost anything. Others 
may make similar claims, but in reality, nothing out 
performs Copy II PC ...at any price. Copy II PC even 
includes a disk speed check and is another "best buy" 
at only $39.95. 

We are the backup professionals. Instead of diluting 
our efforts in creating a wide variety of programs, we 
specialize in offering the very best in backup products. 
So, protect your software investment, before things get 
too hot. 



What if ... (if your software gets too soft? 

You need software insurance. Copy n PC 

Diskettes are fragile, and when a protected program is 
damaged, the results are expensive and inconvenient. If 
you have a backup diskette, though, you can have your 
Apple, IBM or compatible computer back on line within 
seconds . . . affordably. That's software insurance. 

Copy n Plus 

This is the most widely used backup program for the 
Apple. Rated as "one of the best software buys of the 
year" by InCider magazine, its simple menu puts nearly 
every disk command at your fingertips. The manual, 
with more than 70 pages, describes protection 
schemes, and our Backup Book'" lists simple 
instructions for backing up over 300 popular programs. 
The Backup Book is expanded bimonthly, and is always 
available to Copy II Plus owners for only $1.00 (and a 
self -ad dressed, stamped envelope). Best of all. Copy II 
Plus is still only $39.95. 

WildCard 2 (formerly The Alaska Card) 
Designed by us and produced by Eastside Software, 
WildCard 2 is the easiest-to-use, most reliable card 
available. Making backups of your total load software 
can be as easy as pressing the button. Inserting a blank 
disk and hitting the return key twice. WildCard 2 copies 
48K, 64K and 128K software, and, unlike other cards, 
is always ready to go. No preloading software into the 
card or special, preformatted diskettes are required. 
Your backups can be run with or without the card in 
place and can be transferred to hard disks. $139.95 
complete. 
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CENTRAL POINT 
Software, Inc. 

The Backup Professionals 

To order, call 503/244-5782, 8:00-5:30 Mon.-Sat., or 
send your order to: Central Point Software, 9700 SW 
Capitol Hwy, Suite 100. Portland, OR 97219. Please 
include $2.00 for shipping and handling. 



